diff --git a/.gitignore b/.gitignore index 07e8ae0c..d2405db4 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,5 @@ resources/ node_modules/ tech-doc-hugo .DS_Store +package-lock.json +build.sh diff --git a/content/en/docs/Configuration/Certificate Management/server-certificates.md b/content/en/docs/Configuration/Certificate Management/server-certificates.md index ac5d1673..407d6a5b 100644 --- a/content/en/docs/Configuration/Certificate Management/server-certificates.md +++ b/content/en/docs/Configuration/Certificate Management/server-certificates.md @@ -14,7 +14,7 @@ Server certificate are required for all of the following ingresses: | Ingress Name | External address | NAMESPACE | |-------------------------------------------|----------------------------------------|--------------------------------| -| acp | acp.`` | open-banking-acp | +| acp | acp.`` | open-banking-cloudentity | | apimanager | api-manager.`` | open-banking-apim | | gatewaymanager | api-gateway-manager.`` | open-banking-apim | | traffic | api.`` | open-banking-apim | diff --git a/content/en/docs/Configuration/api-management.md b/content/en/docs/Configuration/api-management.md index 6b712f08..197f951a 100644 --- a/content/en/docs/Configuration/api-management.md +++ b/content/en/docs/Configuration/api-management.md @@ -84,9 +84,10 @@ For Open Finance Brazil deployment policy container name is - #AMPLIFY-OB. ![apim-policy-studio-apis](/Images/apim-policy-studio-api-containers.png) If you decide to change one of them, you can use Policy Studio directly for the development environment only. -For other environments, you need to export the Policy Studio projects and build new APIM Docker images to use instead of the standard ones. + +For other environments, you must update the FDX-YAML policy project, which is part of apigateway-config-fdx-7.7.0.20xxxxxx-BNxx.tar.gz, and deploy the configuration as detailed in [Mount the FDX Configuration](/docs/deployment/installation/api-management/fdx-apim/#mount-the-fdx-configuration). -{{% alert title="Note" color="primary" %}} If you make changes to any of the policies in this container then those changes will be overridden by future upgrades {{% /alert %}} +{{% alert title="Note" color="primary" %}} If you make changes to any of the policies in this container then those changes will be overridden by future upgrades. {{% /alert %}} ### Certificates diff --git a/content/en/docs/Overview/Integration/Financial-Data-Exchange-Integration/_index.md b/content/en/docs/Overview/Integration/Financial-Data-Exchange-Integration/_index.md index e78c2f0d..d4ff3767 100644 --- a/content/en/docs/Overview/Integration/Financial-Data-Exchange-Integration/_index.md +++ b/content/en/docs/Overview/Integration/Financial-Data-Exchange-Integration/_index.md @@ -17,7 +17,7 @@ The flow is summarized as follows: All APIs that provide access to data are implemented in the same manner. The consent/data access pattern relating to Account Information is therefore representative regardless of the specific resource (checking accounts, credit cards, loans, and so on). -![FDX Wrokflow](/Images/FDX_Workflow.png) +![FDX Wrokflow](/Images/FDX_Workflow_0.png) ### Steps diff --git a/content/en/docs/Overview/Technical/component.md b/content/en/docs/Overview/Technical/component.md index 01dc9a5e..d685c488 100644 --- a/content/en/docs/Overview/Technical/component.md +++ b/content/en/docs/Overview/Technical/component.md @@ -7,7 +7,7 @@ date: 2021-06-30 The diagram below shows a component view of the Amplify Open Banking solution. -![Component View](/Images/Component_View_0.svg) +![Component View](/Images/Component_View_v320.svg) The table below provides details of each of the components listed above. The list includes the name of the solution building block to which the component relates. @@ -24,16 +24,17 @@ The table below provides details of each of the components listed above. The lis | API Manager | API Management | Management tool for API Management infrastructure. | Mandatory | | | API Traffic | API Management | Responsible for receiving and executing all requests from API consumers. | Mandatory | We recommend adapting the minimum sizing according to the estimated volumes per month. This will allow the pod autoscaler to adapt the number of pods during the peak load.

To support peak load and SLAs multiple replicas must be used. In addition, the Horizontal Pod Autoscaler (HPA) must be activated (by default this is disabled).

The configuration of this component ensures each replica is spread across different nodes (anti-affinity node), which reduces IOPS.

These pods require multiple services and ingress as they have multiple listeners. | APIMCLI | API Management | Job that configures all API objects in the API Manager including users, settings, APIs, organizations, applications and so on. | Mandatory | This job is executed after each upgrade to ensure the API Manager is up-to-date.

All configurations are externalized in a Kubernetes config map to allow the API configuration to be updated by the installer as required.

API descriptions in both US English and Portuguese (for Brazil deployments) are available by default. | -| Cassandra | API Management | Data store for API Manager configuration, throttling, and additional data. | Mandatory | 3 nodes are required in production that must be spread on different availability zones.

Supports Cassandra 3.11.11 only and blocks usage of managed databases in all cloud providers | +| Cassandra | API Management | Data store for API Manager configuration, throttling, and additional data. | Mandatory | 3 nodes are required in production that must be spread on different availability zones.

Supports Cassandra 3.11.11 only and blocks usage of managed databases in all cloud providers. | | Discovery Agent | Amplify Agents | Discovery Agent discovers the API from API Manager and makes it available in Amplify | Mandatory | | | Traceability Agent | Amplify Agents | Traceability Agent uses the API Gateway events to extract the transaction information and send it to the Amplify platform Observability module | Mandatory | | | open-banking-backend (multiple applications) | API Builder | The purpose of these applications is:
  • Provide a mock backend for use in your developer experience if you want.| Conditional | The backend services provided by the open-banking-backend component are created using API Builder and are designed to be reconfigured for use with your backend services to provide the data required for Open Banking.

    You can swap these out for an application with equivalent functionality if you want. However, if this course of action is taken then the benefit of providing an application that is designed to be compliant with the relevant standards/OpenAPI specification is lost. | | MySQL Backend Services | Utilities | Provides storage for mock backend services. | Conditional | Provides storage for backend services where the API Builder applications are using the default configuration. This does not need to be deployed if the backend services APIs are integrated with the Core Banking Applications. | | Cloudentity | Identity Management

    Consent Management | Cloudentity that provides:
    • Authorization Server
    • Token endpoint
    • Management and configuration UI
    | Mandatory | Cloudentity is required to provide:
    • Compliance with the Brazil FAPI Security Profile.
    • Integration with Consent Management to support Open Banking Brazil standards.
    • Integration with external IDPs already implemented by customers.
    | -| acp-seed | Identity Management | Job to implement the default configuration for Cloudentity. | Mandatory | This is required as it it creates the configuration that connects Cloudentity and the API Portal. | -| bank | Consent Management | Open banking sandbox to use with demo applications. | Optional | This only provides demo capabilities, therefore it is not required for production. | -| consent admin | Consent Management | Consent administration demo application | Optional | This only provides demo capabilities, therefore it is not recommended to use this component in production. For Production you can take one of two courses of action:
    • Use the provided template and enhance it for production usage
    • Develop your own web component and call Cloudentity APIs to perform consent operations.
    | -| consent self-service | Consent Management | Consent self-service demo application | Optional | This only provides demo capabilities, therefore it is not recommended to use this component in production. For Production you can take one of two courses of action:
    • Use the provided template and enhance it for production usage
    • Develop your own web component and call Cloudentity APIs to perform consent operations.
    | -| consent page | Consent Management | Consent confirmation demo page | Optional | This only provides demo capabilities, therefore it is not recommended to use this component in production. For Production you can take one of two courses of action:
    • Use the provided template and enhance it for production usage
    • Develop your own web component and call Cloudentity APIs to perform consent operations.
    | -| Hazelcast | Identity Management

    Consent Management | In-memory data grid that supports the operation of Cloudentity. | Mandatory | | -| CockroachDB | Identity Management

    Consent Management | Backend storage for Cloudentity. | Mandatory | | +| acp-cockroachdb-init | Identity Management

    Consent Management | Job to initialize the default configuration for Cloudentity. | Mandatory | | +| CockroachDB | Identity Management

    Consent Management | Cloudentity uses CockroachDB to store various types of data, such as users added to Cloudentity Identity Pools, configuration of client applications connected to a workspace, information about consent grants, and many more. | Mandatory | | +| Redis | Identity Management | The Cloudentity platform uses Redis to store a variety of data types that are well-suited for key-value storage. This includes security tokens such as access tokens, which grant users access to protected resources, and identity tokens, which provide information about the user’s identity. | Mandatory | | +| TimescaleDB | Identity Management | Cloudentity uses TimescaleDB to store audit and analytics/metrics data because it is a powerful and efficient tool for handling large amounts of time-series data. | Optional | | +| consent admin | Consent Management | Consent administration demo application | Optional | This only provides demo capabilities, therefore it is not recommended to use this component in production. For Production you can take one of two courses of action:
    • Use the provided template and enhance it for production usage.
    • Develop your own web component and call Cloudentity APIs to perform consent operations.
    | +| consent self-service | Consent Management | Consent self-service demo application | Optional | This only provides demo capabilities, therefore it is not recommended to use this component in production. For Production you can take one of two courses of action:
    • Use the provided template and enhance it for production usage.
    • Develop your own web component and call Cloudentity APIs to perform consent operations.
    | +| consent page | Consent Management | Consent confirmation demo page | Optional | This only provides demo capabilities, therefore it is not recommended to use this component in production. For Production you can take one of two courses of action:
    • Use the provided template and enhance it for production usage.
    • Develop your own web component and call Cloudentity APIs to perform consent operations.
    | +| acp-import | Identity Management

    Consent Management | Job to implement the default configuration for Cloudentity. | Optional | It creates the configuration for the target specification. If not used, then Cloudentity must to be configured manually. | diff --git a/content/en/docs/Reference/brazil/obb-api-list.md b/content/en/docs/Reference/brazil/obb-api-list.md index d5a8a8f8..86d66073 100644 --- a/content/en/docs/Reference/brazil/obb-api-list.md +++ b/content/en/docs/Reference/brazil/obb-api-list.md @@ -1,11 +1,11 @@ --- -title: "List of APIs included in Amplify Open Banking" +title: "List of Open Finance Brazil APIs included in Amplify Open Banking" linkTitle: "API List" weight: 2 type: bigtable --- -The table below provides the list of APIs supported in the Amplify Open Banking solution. +The table below provides the list of Open Finance Brazil APIs supported in the Amplify Open Banking solution. | Name | Phase | Guidance | URI(s) | | ---- | ----- | -------- | ------ | @@ -14,19 +14,25 @@ The table below provides the list of APIs supported in the Amplify Open Banking | Service Channels API | 1 | Provides information on "channels" at the bank, including information on branches, phone numbers, and ATMs.

    This is an open data API and requires no authentication for access. It is rate-limited at the thresholds described in the standards. | /channels/v1/branches
    /channels/v1/electronic-channels
    /channels/v1/phone-channels
    /channels/v1/banking-agents
    /channels/v1/shared-automated-teller-machines | | Products and Services API | 1 | Provides information on personal and business products across a range of product types including:
    • Current accounts.
    • Loans.
    • Financing.
    • Invoice financing.
    • Credit cards.
    • Unarranged overdrafts.
    This is an open data API and requires no authentication for access. It is rate-limited at the thresholds described in the standards. | /products-services/v1/personal-accounts
    /products-services/v1/business-accounts
    /products-services/v1/personal-loans
    /products-services/v1/business-loans
    /products-services/v1/personal-financings
    /products-services/v1/business-financings
    /products-services/v1/personal-invoice-financings
    /products-services/v1/business-invoice-financings
    /products-services/v1/personal-credit-cards
    /products-services/v1/business-credit-cards
    /products-services/v1/personal-unarranged-account-overdraft
    /products-services/v1/business-unarranged-account-overdraft | | Metrics API | 1+ | Provides metrics data for consumption by the Directory.

    This is an open data API and requires no authentication for access. It is rate-limited at the thresholds described in the standards.

    It is assumed that this API must be implemented regardless of whether the implementor starts later than Phase 1. | /admin/v1/metrics | -| Consent API | 2 | Provides the implementation of the Lodging Intent pattern that allows a TPP to create and maintain consent at the bank.

    It covers all Phase 2 APIs, with one-or-more permission codes per API defined in the OpenAPI document. | /consents/v1/consents
    /consents/v1/consents/{consentId}
    /consents/v2/consents
    /consents/v2/consents/{consentId} | -| Resources API | 2 | The Resources API creates a bridge between the consent granted by an End User and the accounts they hold and have agreed to share.

    It is used by a TPP to retrieve the accounts - regardless of type - that the End User has agreed to share. Each Account ID is shared with its type and the status of the account.

    Note that one of the status codes - `PENDING_AUTHORISATION` - is unlikely to ever be returned where only a single End User is required to consent to access.

    Customer consent is required for a TPP to access this API and retrieve a customer's data. | /resources/v1/resources | -| Customer API | 2 | The Customer API provides information on the customer who provided consent or the organization, depending on whether the customer is a personal or business customer.

    The endpoints support the retrieval of the following data:
    • The identity of the customer including their legal identifier, social security number (where applicable) and address.
    • Financial "qualification" records, namely their income. In the case of businesses this includes information on their economic activities.
    • Any information on the customer's financial relationships, namely the products and services they hold.
    Customer consent is required for a TPP to access this API and retrieve a customer's data. | /customers/v1/personal/identifications
    /customers/v1/business/identifications
    /customers/v1/personal/qualifications
    /customers/v1/business/qualifications
    /customers/v1/personal/financial-relations
    /customers/v1/business/financial-relations
    /customers/v2/personal/identifications
    /customers/v2/business/identifications
    /customers/v2/personal/qualifications
    /customers/v2/business/qualifications
    /customers/v2/personal/financial-relations
    /customers/v2/business/financial-relations | -| Credit Card API | 2 | This API provides credit card information including limits, transactions, bills, and billed transactions.

    Customer consent is required for a TPP to access this API and retrieve a customer's data. | /credit-cards-accounts/v1/accounts
    /credit-cards-accounts/v1/accounts/{creditCardAccountId}
    /credit-cards-accounts/v1/accounts/{creditCardAccountId}/limits
    /credit-cards-accounts/v1/accounts/{creditCardAccountId}/transactions
    /credit-cards-accounts/v1/accounts/{creditCardAccountId}/bills
    /credit-cards-accounts/v1/accounts/{creditCardAccountId}/bills/{billId}/transactions
    /credit-cards-accounts/v2/accounts
    /credit-cards-accounts/v2/accounts/{creditCardAccountId}
    /credit-cards-accounts/v2/accounts/{creditCardAccountId}/limits
    /credit-cards-accounts/v2/accounts/{creditCardAccountId}/transactions
    /credit-cards-accounts/v2/accounts/{creditCardAccountId}/bills
    /credit-cards-accounts/v2/accounts/{creditCardAccountId}/bills/{billId}/transactions
    /credit-cards-accounts/v2/accounts/{creditCardAccountId}/transactions-current | -| Accounts API | 2 | This API provides account information including balances, transactions, and limits.

    Customer consent is required for a TPP to access this API and retrieve a customer's data. | /accounts/v1/accounts
    /accounts/v1/accounts/{accountId}
    /accounts/v1/accounts/{accountId}/balances
    /accounts/v1/accounts/{accountId}/transactions
    /accounts/v1/accounts/{accountId}/limits
    /accounts/v2/accounts
    /accounts/v2/accounts/{accountId}
    /accounts/v2/accounts/{accountId}/balances
    /accounts/v2/accounts/{accountId}/transactions
    /accounts/v2/accounts/{accountId}/transactions-current
    /accounts/v2/accounts/{accountId}/overdraft-limits | -| Loans API | 2 | This API provides information on customer loans including warranties, payments, and scheduled installments.

    Customer consent is required for a TPP to access this API and retrieve a customer's data. | /loans/v1/contracts
    /loans/v1/contracts/{contractId}
    /loans/v1/contracts/{contractId}/warranties
    /loans/v1/contracts/{contractId}/payments
    /loans/v1/contracts/{contractId}/scheduled-instalments
    /loans/v2/contracts
    /loans/v2/contracts/{contractId}
    /loans/v2/contracts/{contractId}/warranties
    /loans/v2/contracts/{contractId}/payments
    /loans/v2/contracts/{contractId}/scheduled-instalments| -| Financing API | 2 | This API provides information on customer financing including warranties, payments, and scheduled installments.

    Customer consent is required for a TPP to access this API and retrieve a customer's data. | /financings/v1/contracts
    /financings/v1/contracts/{contractId}
    /financings/v1/contracts/{contractId}/warranties
    /financings/v1/contracts/{contractId}/payments
    /financings/v1/contracts/{contractId}/scheduled-instalments
    /financings/v2/contracts
    /financings/v2/contracts/{contractId}
    /financings/v2/contracts/{contractId}/warranties
    /financings/v2/contracts/{contractId}/payments
    /financings/v2/contracts/{contractId}/scheduled-instalments | -| Advances API | 2 | This API provides information on customer unarranged overdrafts including warranties, payments, and scheduled installments.

    Customer consent is required for a TPP to access this API and retrieve a customer's data. | /unarranged-accounts-overdraft/v1/contracts
    /unarranged-accounts-overdraft/v1/contracts/{contractId}
    /unarranged-accounts-overdraft/v1/contracts/{contractId}/warranties
    /unarranged-accounts-overdraft/v1/contracts/{contractId}/payments
    /unarranged-accounts-overdraft/v1/contracts/{contractId}/scheduled-instalments
    /unarranged-accounts-overdraft/v2/contracts
    /unarranged-accounts-overdraft/v2/contracts/{contractId}
    /unarranged-accounts-overdraft/v2/contracts/{contractId}/warranties
    /unarranged-accounts-overdraft/v2/contracts/{contractId}/payments
    /unarranged-accounts-overdraft/v2/contracts/{contractId}/scheduled-instalments| -| Invoice Financing API | 2 | This API provides information on customer invoice financing including warranties, payments, and scheduled installments.

    Customer consent is required for a TPP to access this API and retrieve a customer's data. | /invoice-financings/v1/contracts
    /invoice-financings/v1/contracts/{contractId}
    /invoice-financings/v1/contracts/{contractId}/warranties
    /invoice-financings/v1/contracts/{contractId}/payments
    /invoice-financings/v1/contracts/{contractId}/scheduled-instalments
    /invoice-financings/v2/contracts
    /invoice-financings/v2/contracts/{contractId}
    /invoice-financings/v2/contracts/{contractId}/warranties
    /invoice-financings/v2/contracts/{contractId}/payments
    /invoice-financings/v2/contracts/{contractId}/scheduled-instalments | -| Payments API | 3 | The Payments API is the core deliverable for Phase 3 of Open Finance Brazil. It incorporates two operations:
    • The creation of consent for a single immediate payment.
    • The execution of the payment instruction once consent is authorized.
    The payment instruction itself is transmitted using PIX. It therefore relies on attributes from the PIX payment set-up method e.g. QR Code made available to the payer, PIX "key" of the payee.
    | /payments/v1/consents
    /payments/v1/consents/{consentId}
    /payments/v1/pix/payments
    /payments/v1/pix/payments/{paymentId}
    /payments/v2/consents
    /payments/v2/consents/{consentId}
    /payments/v2/pix/payments
    /payments/v2/pix/payments/{paymentId}| -| Capitalization API | 4 | The APIs described in this document refer to the Capitalization API of the OpenInsurance phase of Open Finance Brasil. | /opendata-capitalization/v1/bonds | -| Investments API | 4 | These APIs aim at sharing data about Investments and their characteristics among the Financial Institutions participating in Open Finance Brasil | /opendata-investments/v1/funds
    /opendata-investments/v1/bank-fixed-incomes
    /opendata-investments/v1/credit-fixed-incomes
    /opendata-investments/v1/variable-incomes
    /opendata-investments/v1/treasure-titles | -| Exchange API | 4 | Open Finance Brasil Exchange API – Phase 4. API that returns Forex information. | /opendata-exchange/v1/online-rates
    /opendata-exchange/v1/vet-values | -| Acquiring Services API | 4 | Open Finance Brasil Acquiring Services API – Phase 4. API that returns Accreditation information. | /opendata-acquiring-services/v1/businesses
    /opendata-acquiring-services/v1/personals | -| Pension API | 4 | Open Finance Brasil Pension API – Phase 4. API that returns Pension information. | /opendata-pension/v1/risk-coverages
    /opendata-pension/v1/survival-coverages | -| Insurance API | 4 | The APIs described in this document refer to the Insurance API of the OpenInsurance phase of Open Finance Brasil. | /opendata-insurance/v1/automotive
    /opendata-insurance/v1/homes
    /opendata-insurance/v1/personals | \ No newline at end of file +| Consent API | 2 | Provides the implementation of the Lodging Intent pattern that allows a TPP to create and maintain consent at the bank.

    It covers all Phase 2 APIs, with one-or-more permission codes per API defined in the OpenAPI document. | /consents/v2/consents
    /consents/v2/consents/{consentId}
    /consents/{consentId}/extends | +| Resources API | 2 | The Resources API creates a bridge between the consent granted by an End User and the accounts they hold and have agreed to share.

    It is used by a TPP to retrieve the accounts - regardless of type - that the End User has agreed to share. Each Account ID is shared with its type and the status of the account.

    Note that one of the status codes - `PENDING_AUTHORISATION` - is unlikely to ever be returned where only a single End User is required to consent to access.

    Customer consent is required for a TPP to access this API and retrieve a customer's data. | /resources/v2/resources | +| Customer API | 2 | The Customer API provides information on the customer who provided consent or the organization, depending on whether the customer is a personal or business customer.

    The endpoints support the retrieval of the following data:
    • The identity of the customer including their legal identifier, social security number (where applicable) and address.
    • Financial "qualification" records, namely their income. In the case of businesses this includes information on their economic activities.
    • Any information on the customer's financial relationships, namely the products and services they hold.
    Customer consent is required for a TPP to access this API and retrieve a customer's data. | /customers/v2/personal/identifications
    /customers/v2/business/identifications
    /customers/v2/personal/qualifications
    /customers/v2/business/qualifications
    /customers/v2/personal/financial-relations
    /customers/v2/business/financial-relations | +| Credit Card API | 2 | This API provides credit card information including limits, transactions, bills, and billed transactions.

    Customer consent is required for a TPP to access this API and retrieve a customer's data. | /credit-cards-accounts/v2/accounts
    /credit-cards-accounts/v2/accounts/{creditCardAccountId}
    /credit-cards-accounts/v2/accounts/{creditCardAccountId}/limits
    /credit-cards-accounts/v2/accounts/{creditCardAccountId}/transactions
    /credit-cards-accounts/v2/accounts/{creditCardAccountId}/bills
    /credit-cards-accounts/v2/accounts/{creditCardAccountId}/bills/{billId}/transactions
    /credit-cards-accounts/v2/accounts/{creditCardAccountId}/transactions-current | +| Accounts API | 2 | This API provides account information including balances, transactions, and limits.

    Customer consent is required for a TPP to access this API and retrieve a customer's data. | /accounts/v2/accounts
    /accounts/v2/accounts/{accountId}
    /accounts/v2/accounts/{accountId}/balances
    /accounts/v2/accounts/{accountId}/transactions
    /accounts/v2/accounts/{accountId}/transactions-current
    /accounts/v2/accounts/{accountId}/overdraft-limits | +| Loans API | 2 | This API provides information on customer loans including warranties, payments, and scheduled installments.

    Customer consent is required for a TPP to access this API and retrieve a customer's data. | /loans/v2/contracts
    /loans/v2/contracts/{contractId}
    /loans/v2/contracts/{contractId}/warranties
    /loans/v2/contracts/{contractId}/payments
    /loans/v2/contracts/{contractId}/scheduled-instalments| +| Financing API | 2 | This API provides information on customer financing including warranties, payments, and scheduled installments.

    Customer consent is required for a TPP to access this API and retrieve a customer's data. | /financings/v2/contracts
    /financings/v2/contracts/{contractId}
    /financings/v2/contracts/{contractId}/warranties
    /financings/v2/contracts/{contractId}/payments
    /financings/v2/contracts/{contractId}/scheduled-instalments | +| Advances API | 2 | This API provides information on customer unarranged overdrafts including warranties, payments, and scheduled installments.

    Customer consent is required for a TPP to access this API and retrieve a customer's data. | /unarranged-accounts-overdraft/v2/contracts
    /unarranged-accounts-overdraft/v2/contracts/{contractId}
    /unarranged-accounts-overdraft/v2/contracts/{contractId}/warranties
    /unarranged-accounts-overdraft/v2/contracts/{contractId}/payments
    /unarranged-accounts-overdraft/v2/contracts/{contractId}/scheduled-instalments| +| Invoice Financing API | 2 | This API provides information on customer invoice financing including warranties, payments, and scheduled installments.

    Customer consent is required for a TPP to access this API and retrieve a customer's data. | /invoice-financings/v2/contracts
    /invoice-financings/v2/contracts/{contractId}
    /invoice-financings/v2/contracts/{contractId}/warranties
    /invoice-financings/v2/contracts/{contractId}/payments
    /invoice-financings/v2/contracts/{contractId}/scheduled-instalments | +| Payments API | 3 | The Payments API is the core deliverable for Phase 3 of Open Finance Brazil. It incorporates two operations:
    • The creation of consent for a single immediate payment.
    • The execution of the payment instruction once consent is authorized.
    The payment instruction itself is transmitted using PIX. It therefore relies on attributes from the PIX payment set-up method e.g. QR Code made available to the payer, PIX "key" of the payee.
    | /payments/v2/consents
    /payments/v2/consents/{consentId}
    /payments/v2/pix/payments
    /payments/v2/pix/payments/{paymentId}
    /payments/v3/consents
    /payments/v3/consents/{consentId}
    /payments/v3/pix/payments
    /payments/v3/pix/payments/{paymentId}| +| Capitalization API | 4 | The APIs described in this document refer to the Capitalization API of the OpenInsurance phase of Open Finance Brazil. | /opendata-capitalization/v1/bonds | +| Investments API | 4 | These APIs aim at sharing data about Investments and their characteristics among the Financial Institutions participating in Open Finance Brazil. | /opendata-investments/v1/funds
    /opendata-investments/v1/bank-fixed-incomes
    /opendata-investments/v1/credit-fixed-incomes
    /opendata-investments/v1/variable-incomes
    /opendata-investments/v1/treasure-titles | +| Exchange API | 4 | Open Finance Brazil Exchange API – Phase 4. API that returns Forex information. | /opendata-exchange/v1/online-rates
    /opendata-exchange/v1/vet-values | +| Acquiring Services API | 4 | Open Finance Brazil Acquiring Services API – Phase 4. API that returns Accreditation information. | /opendata-acquiring-services/v1/businesses
    /opendata-acquiring-services/v1/personals | +| Pension API | 4 | Open Finance Brazil Pension API – Phase 4. API that returns Pension information. | /opendata-pension/v1/risk-coverages
    /opendata-pension/v1/survival-coverages | +| Insurance API | 4 | The APIs described in this document refer to the Insurance API of the OpenInsurance phase of Open Finance Brazil. | /opendata-insurance/v1/personals | +| Bank Fixed Incomes API | 4 | The Bank Fixed Incomes API makes it possible to share data on bank fixed income investment products, such as listing of products, product details, product position and historical and recent movements of the customer's product. | /bank-fixed-incomes/v1/investments
    /bank-fixed-incomes/v1/investments/{investmentId}
    /bank-fixed-incomes/v1/investments/{investmentId}/balances
    /bank-fixed-incomes/v1/investments/{investmentId}/transactions
    /bank-fixed-incomes/v1/investments/{investmentId}/transactions-current | +| Credit Fixed Incomes API | 4 | Gets the list of Fixed Income Credit operations maintained by the client at the transmitting institution and for which he has provided consent. | /credit-fixed-incomes/v1/investments
    /credit-fixed-incomes/v1/investments/{investmentId}
    /credit-fixed-incomes/v1/investments/{investmentId}/balances
    /credit-fixed-incomes/v1/investments/{investmentId}/transactions
    /credit-fixed-incomes/v1/investments/{investmentId}/transactions-current | +| Variable Incomes API | 4 | Open Finance Brazil Variable Income operations information API – Phase 4. API that returns information on Variable Income type investment operations maintained at transmitting institutions by their clients, including data such as product information, quantity, balances in the client's position, financial movements and details of the negotiation note. | /variable-incomes/v1/investments
    /variable-incomes/v1/investments/{investmentId}
    /variable-incomes/v1/investments/{investmentId}/balances
    /variable-incomes/v1/investments/{investmentId}/transactions
    /variable-incomes/v1/investments/{investmentId}/transactions-current
    /variable-incomes/v1/investments/{investmentId}/broker-notes/{brokerNoteId} | +| Treasure Titles API | 4 | API for information on operations of Treasury Direct Bonds Open Finance Brazil – Phase 4. API that returns information on investment operations of the type Treasury Direct Bonds held at transmitting institutions by its clients, including data such as product information, quantity, balances in customer position and financial movements. | /treasure-titles/v1/investments
    /treasure-titles/v1/investments/{investmentId}
    /treasure-titles/v1/investments/{investmentId}/balances
    /treasure-titles/v1/investments/{investmentId}/transactions
    /treasure-titles/v1/investments/{investmentId}/transactions-current | +| Investment Funds API | 4 | API for investment fund operations information Open Finance Brazil – Phase 4. API that returns information on investment operations of the type Investment Funds maintained at transmitting institutions by their clients, including data such as product information, quantity, balances in position of the customer and financial transactions. | /funds/v1/investments
    /funds/v1/investments/{investmentId}
    /funds/v1/investments/{investmentId}/balances
    /funds/v1/investments/{investmentId}/transactions
    /funds/v1/investments/{investmentId}/transactions-current | +| Foreign Exchange Operations Information API | 4 | Open Finance Brazil Foreign Exchange Operations Information API – Phase 4. API that returns information on foreign exchange operations carried out at transmitting institutions by its clients, including data such as information on the contracted operation, value of the operation in national and foreign currency, classification of the operation, form of delivery, VET and, when applicable, amount to be settled. | /exchanges/v1/operations
    /exchanges/v1/operations/{operationId}
    /exchanges/v1/operations/{operationId}/events | diff --git a/content/en/docs/Reference/fdx/_index.md b/content/en/docs/Reference/fdx/_index.md index d5350570..c3a32cf5 100644 --- a/content/en/docs/Reference/fdx/_index.md +++ b/content/en/docs/Reference/fdx/_index.md @@ -13,5 +13,8 @@ The table below provides the list of FDX APIs supported in the Amplify Open Bank | API Name | Guidance | URI(s) | | -------- | -------- | ------ | | Core | This API provides account information including balances, transactions, statements and customer information.

    Customer consent is required for a Data Recipient to access this API and retrieve a customer's data. | /fdx/v5/accounts
    /fdx/v5/accounts/{accountId}
    /fdx/v5/accounts/{accountId}/statements
    /fdx/v5/accounts/{accountId}/statements/{statementId}
    /fdx/v5/accounts/{accountId}/transactions
    /fdx/v5/accounts/{accountId}/transaction-images/{imageId}
    /fdx/v5/accounts/{accountId}/contact
    /fdx/v5/core/customers
    /fdx/v5/core/customers/{customerId}
    /fdx/v5/accounts/{accountId}/payment-networks | +| Consent | A standardized API supporting the synchronization of consent display messaging and end user experience is required to enable Data Recipients and Data Providers to negotiate user consent on-the-fly rather than through advanced administrative setup. | /fdx/v5/consents/{consentId}
    /fdx/v5/consents/{consentId}/revocation | +| Customer | Enable authenticated users who are customers of data providers to share their non-sensitive financial product information with data recipients. | /fdx/v5/customers
    /fdx/v5/customers/current
    /fdx/v5/customers/{customerId} | | Money Movement | It incorporates four operations:
    • Payee management
    • Payment Initiation
    • Recurring payments
    • Internal transfers
    | /fdx/v5/payees
    /fdx/v5/payees/{payeeId}
    /fdx/v5/payments
    /fdx/v5/payments/{paymentId}
    /fdx/v5/recurring-payments
    /fdx/v5/recurring-payments/{recurringPaymentId}
    /fdx/v5/recurring-payments/{recurringPaymentId}/payments
    /fdx/v5/transfers
    /fdx/v5/transfers/{transferId} | -| Tax | It incorporates two operations:
    • Get the full lists of tax document data and tax form images available for a specific year for the current authorized customer
    • Get the form image or TaxDataList as json for a single tax document for the customer.
    | /fdx/v5/tax-forms
    /fdx/v5/tax-forms/{taxFormId} | \ No newline at end of file +| Tax | It incorporates two operations:
    • Get the full lists of tax document data and tax form images available for a specific year for the current authorized customer.
    • Get the form image or TaxDataList as json for a single tax document for the customer.
    | /fdx/v5/tax-forms
    /fdx/v5/tax-forms/{taxFormId} | +| Recipient Registration | Dynamic Client Registration API. | /fdx/v5/register
    /fdx/v5/register/{clientId} | diff --git a/content/en/docs/Release-Notes/_index.md b/content/en/docs/Release-Notes/_index.md index ede823a3..82de2188 100644 --- a/content/en/docs/Release-Notes/_index.md +++ b/content/en/docs/Release-Notes/_index.md @@ -6,6 +6,69 @@ weight: 20 Amplify Open Banking updates are cumulative, comprising new features and changes delivered in previous updates unless specifically indicated otherwise in the Release notes. +## Upgrade existing deployment + +Follow the [upgrade instructions](/docs/deployment/upgrade) to apply this update. + +## Release v3.2.0 + +In this update we have upgraded FDX APIs to v5.2.1 and added support for Consent, Customer and Recipient Registration v5.2.1 APIs. + +In addition, we have added Phase4b APIs for Open Finance Brazil. + +This update also includes migration to YAML Entity Store from existing XML based API Gateway configuration. + +### New features and enhancements for v3.2.0 + +The following new features and enhancements are available in this update. + +#### Upgrade of FDX APIs to v5.2.1 + +* Core and Tax APIs are upgraded to v5.2.1 +* Consent, Customer, Fraud and Recipient Registration v5.2.1 APIs are added in this release. For updated FDX API list, see [FDX API List](/docs/reference/fdx/#list-of-fdx-apis-included-in-amplify-open-banking). + +#### Open Finance Brazil updates + +* Consent v2.2 beta1 support +* Phase4B APIs support +* Payment Initiation V3 support +* Phase2 v2.0.1 and 2.1.0 APIs update + +#### API Management changes + +* API Gateway is upgraded to "May 2023 release(7.7-20230530)". For API Gateway release notes, see [API Gateway and API Manager 7.7 May 2023 Release Notes](https://docs.axway.com/bundle/axway-open-docs/page/docs/apim_relnotes/20230530_apimgr_relnotes/index.html). +* Migrated the API Gateway configuration from XML based FED to YAML Entity Store. For more information on YAML Entity store, see [YAML configuration](https://docs.axway.com/bundle/axway-open-docs/page/docs/apim_yamles/index.html). +* Added merge dir capabilities and Entity Store externalization. For more details on this topic, see [FDX API Management Configuration](/docs/deployment/installation/api-management/fdx-apim) for FDX and [Open Finance Brazil API Management Configuration](/docs/deployment/installation/api-management/obb-apim/) for Open Finance Brazil deployments. +* Some improvements to the Helm chart for the deployment of API Gateway, discovery and traceability agents. + +API Gateway changes specific to Open Finance Brazil deployments: + +* Removed dependency from envSettings.props file moving some variables to environment variables. +* Updated filebeat for backwards compatibility + * Upgraded from version 7.9 to 8.10.4 + +API Manager changes specific to Open Finance Brazil deployments: + +* Upgraded to the latest apimcli image 1.14.2 +* Removed built in configuration files and added them as customizable configmaps +* Removed deprecated APIs +* Introduced APIM Settings configurable via values.yaml + +Added a new module KPS-Config for Open Finance Brazil deployments: + +* Must be executed after APIM full installation + +#### Cloudentity Updates + +This release includes the Cloudentity v2.19.0-1. This new version includes: + +* Initial support for Open Finance Consent Renewal specification new endpoints: + * GET /open-banking/consents/v2/consents/{consentID}/extends + * POST /open-banking/consents/v2/consents/{consentID}/extends +* Please note that for FDX deployments, Cloudentity v2.15.1-1 must be used. + +For more information on Cloudentity changes, see [Cloudentity Release Notes](https://cloudentity.com/developers/deployment-and-operations/release-notes/). + ## Release v3.1.0 Release notes for Amplify Open Banking v3.1.0. In this update, we have added support for Financial Data Exchange (FDX) APIs. These new APIs will allow customers in North America to deploy the Amplify Open Banking solution. @@ -14,11 +77,7 @@ Axway API Gateway is upgraded to the  "Nov 2022 release(7.7-20221130)"  in the In addition, we have made a significant update and restructuring of our documentation to reflect these changes. -### Upgrade existing deployment - -Follow the [upgrade instructions](/docs/deployment/upgrade) to apply this update. - -### New features and enhancements +### New features and enhancements for v3.1.0 The following new features and enhancements are available in this update. @@ -40,10 +99,10 @@ This release includes the following updates and features to keep support of Open * Mock backend APIs for Open Finance Brazil phase 2 v2 are updated to support the functional tests. * Consent flow is updated to fix a bug of consent request date due to timezone configuration. -### Known Issues +### Known Issues for v3.1.0 The following are known issues for this update. #### External clients are not created in API Manager applications -External Client is not configured in the applications created during the installation of `open-banking-fdx-apim-config` helm chart. Use API Manager to add the external client configuration in existing applications. \ No newline at end of file +External Client is not configured in the applications created during the installation of `open-banking-fdx-apim-config` helm chart. Use API Manager to add the external client configuration in existing applications. diff --git a/content/en/docs/Validation/troubleshooting.md b/content/en/docs/Validation/troubleshooting.md index ebbfbc9a..58299eac 100644 --- a/content/en/docs/Validation/troubleshooting.md +++ b/content/en/docs/Validation/troubleshooting.md @@ -90,13 +90,13 @@ Cloudentity logs can be accessed at the container standard output. In the Kubern * Identify the acp-xxxxx-xxx pod name ```bash -kubectl get pods -n open-banking-consent +kubectl get pods -n open-banking-cloudentity ``` * Display the logs: ```bash -kubectl logs acp-xxxxx-xxx -n open-banking-acp +kubectl logs acp-xxxxx-xxx -n open-banking-cloudentity ``` Use `-f` command option to get help to follow the logs stream. diff --git a/content/en/docs/deployment/installation/API-Management/_index.md b/content/en/docs/deployment/installation/API-Management/_index.md index 17b57d87..666404a9 100644 --- a/content/en/docs/deployment/installation/API-Management/_index.md +++ b/content/en/docs/deployment/installation/API-Management/_index.md @@ -3,28 +3,53 @@ title: "API Management Installation" linkTitle: "API Management" weight: 3 --- -Install API Management for the Amplify Open Banking solution. +Install API Management for the Amplify Open Banking solution. This guide should be used in conjunction with [Helm Deployment](https://docs.axway.com/bundle/axway-open-docs/page/docs/apim_installation/apigw_containers/deployment_flows/axway_image_deployment/helm_deployment/index.html) instructions for API Gateway installation. -## Download the API Management (APIM) Helm charts +## Deploy a Cassandra cluster -Download the Amplify Open Banking API Management (APIM) Helm charts to customize them locally. +Follow the Cassandra deployment steps outlined in [Deploy a Cassandra cluster](https://docs.axway.com/bundle/axway-open-docs/page/docs/apim_installation/apigw_containers/deployment_flows/axway_image_deployment/helm_deployment/index.html#deploy-a-cassandra-cluster). -### Financial Data Exchange (FDX) +## Fetch the Helm chart to examine the values file -```bash -helm pull axway/open-banking-fdx-apim --untar -helm pull axway/open-banking-fdx-apim-config --untar -``` +Run a `helm fetch` command on the added repository to view the Helm `values.yaml` file: -You should get the `open-banking-fdx-apim` and `open-banking-fdx-apim-config` local folders. +* For FDX deployment, to fetch helm chart: -### Open Finance Brazil + ```bash + helm fetch axway/open-banking-fdx-apim --untar + ``` -```bash -helm pull axway/open-banking-apim --untar -helm pull axway/open-banking-apim-config --untar -``` + This command creates a directory `open-banking-fdx-apim` containing the complete chart, including the `values.yaml` file. -You should get the `open-banking-apim` and `open-banking-apim-config` local folders. +* For Open Finance Brazil deployment, to fetch helm chart: -Follow the instructions in below subsections for more information on specific deployments. \ No newline at end of file + ```bash + helm fetch axway/open-banking-obb-apigateway --untar + ``` + + This command creates a directory `open-banking-obb-apigateway` containing the complete chart, including the `values.yaml` file. + +## Create a customized values.yaml file + +Create a customized `values` file, for example, `myvalues.yaml`, and make your customizations. This file should contain only the sections of the `values.yaml` file that you wish to override. Any values not present in the customized file will be picked up from the original `values.yaml` file. + +Additional details about customizing values.yaml are available at [Create a customized values.yaml file](https://docs.axway.com/bundle/axway-open-docs/page/docs/apim_installation/apigw_containers/deployment_flows/axway_image_deployment/helm_deployment/index.html#create-a-customized-valuesyaml-file). + +### Open Banking parameters + +The following parameters are required for any openbanking deployment. + +| Value | Description | Default value | +|:------------- |:------------------------------------- |:-------------- | +| openbanking.enabled | Enable or disable openbanking deployment | true | +| openbanking.standard | Set the Open Banking specification or standard | FDX | + +### Sample customized values file + +Click [openbanking_sample_values.yaml](/samples/apimanagement/openbanking_sample_values.yaml) to download an example of a customized `myvalues.yaml` file. + +### Install API Gateway using your customized YAML file + +To install API Gateway using your customized YAML file, follow the installation instructions from [Install API Gateway using your customized YAML file](https://docs.axway.com/bundle/axway-open-docs/page/docs/apim_installation/apigw_containers/deployment_flows/axway_image_deployment/helm_deployment/index.html#install-api-gateway-using-your-customized-yaml-file). + +When installation is finished, go to the instructions in the subsections below for more details on particular deployments. diff --git a/content/en/docs/deployment/installation/API-Management/fdx-apim.md b/content/en/docs/deployment/installation/API-Management/fdx-apim.md index 9a7744b5..171f8c2c 100644 --- a/content/en/docs/deployment/installation/API-Management/fdx-apim.md +++ b/content/en/docs/deployment/installation/API-Management/fdx-apim.md @@ -1,268 +1,107 @@ --- -title: "FDX API Management Installation" +title: "FDX API Management Configuration" linkTitle: "FDX API Management" weight: 1 --- +## Configure API Gateway -## Customize the APIM Helm chart +Once installation is complete, following the instructions at [Install API Gateway using your customized YAML file](https://docs.axway.com/bundle/axway-open-docs/page/docs/apim_installation/apigw_containers/deployment_flows/axway_image_deployment/helm_deployment/index.html#install-api-gateway-using-your-customized-yaml-file), and mount the FDX policies and configuration files using the below steps. -Customize the `open-banking-fdx-apim/values.yaml` file as follows. +### Download the API Gateway configuration files -### Base parameters +To download the Amplify Open Banking API Management configuration package for FDX deployment, go to [Axway Repository](https://repository.axway.com/), and search for “Amplify Open Banking”, then check the `Utility` box. Then download the `apigateway-config-fdx-7.7.0.20xxxxxx-BNxx.tar.gz` file. -The following parameters are required for any deployment. +After the download is finished, extract the archive's contents. -| Value | Description | Default value | -|:------------- |:------------------------------------- |:-------------- | -| global.platform | Select the platform to configure appropriate objects (like storage for RWM).
    Possible values are AWS, AZURE, MINIKUBE. | None | -| global.domainName | Set the domainname for all ingress. | None | -| global.env | Set the default environment. | dev | -| global.dockerRegistry.username | Login name to pull Docker images from the Axway Repository. | None | -| global.dockerRegistry.token | Password token to pull Docker images from the Axway Repository. | None | -| global.denyDemoLogin | Disables the demo login idp. It should be disabled on the customer environment. | false | -| global.awsVolumeHandle | Value available only for AWS | None | -| anm.admin.username | API Gateway admin username | admin | -| anm.admin.password | API Gateway admin password | None | -| apimgr.admin.username | API Manager admin username | apiadmin | -| apimgr.admin.initPassword | API Manager initial admin password | None | -| apimgr.admin.password | API Manager admin password | None | - -With these base parameters set, you can install the Helm chart. See [Install the APIM Helm chart](#install-the-apim-helm-chart). - -This deployment uses cert-manager and the [Let's Encrypt](https://letsencrypt.org) issuer to provide certificates. This requires an ingress controller (nginx) that listens on a public IP. You must replace the certificates provided with the sample Helm chart with your own certificates. - -You can also customize the chart values with the following sub-sections. - -### Product license - -A temporary license file is embedded in the default Docker image. - -This license key has a lifetime to two months maximum. - -This license is perfect for a demo or a proof of concept but another license key must be added for production environments. - -| Value | Description | Default value | -|:------------- |:------------------------------------- |:-------------- | -| global.apimLicense | Insert your license key. An example is in the default value file. | None | - -### External Cassandra - -According to the reference architecture, the Cassandra database is external to the cluster. Change the following values according to the cassandra configuration. - -The Helm chart is delivered with an internal cassandra database that would work for non-production environments. You can change this parameter to use an external one. A 3 node Cassandra HA setup is required for production environments at minimum. - -```yaml -cassandra: - external: true - adminName: "cassandra" - adminPasswd: "" - host1: "cassandra" - host2: "cassandra" - host3: "cassandra" +```bash +tar -xzf apigateway-config-fdx-7.7.0.20xxxxxx-BNxx.tar.gz ``` -Refer to the [Administer Apache Cassandra](https://docs.axway.com/bundle/axway-open-docs/page/docs/cass_admin/index.html) in the API Management documentation to configure and manage the Apache Cassandra database for API Gateway and API Manager. - -### Root CA for MTLS clients +This command creates a directory `apigateway-config-fdx-7.7.0.20xxxxxx-BNxx` containing following sub-directories and files. -Optionally, you can add a new root CA for MTLS ingress during the first deployment. - -The mutual authentication is provided by Nginx. It requires a Kubernetes secret that contains all rootCA used for client certificates (used by TPPs). - -The different root CA certificates must be concatenated and encoded in base64. - -| Value | Description | Default value | -|:------------- |:------------------------------------- |:-------------- | -| apitraffic.ingressMtlsRootCa | All concatenated root CA encoded in base64. | yes | - -### Customize storage class - -Only if needed, you can change the storage class. - -The APIM deployment needs a storage class in Read/Write Many. A custom storage class can be set if the cluster does not use the standard deployment for Azure, AWS, or if the deployment is on a vanilla Kubernetes. - -| Value | Description | Default value | -|:------------- |:------------------------------------- |:-------------- | -| Global.customStorageClass.scrwm | Allow to specify a storage class to mount a “Read Write Many” volume on pod.
    It is used to share metrics between monitoring and analytics. | None | - -### Specify a Wildcard certificate - -If you do not use cert-manager for your cluster, you can specify a unique certificate for all ingress of this chart. - -It is possible to use a custom wildcard certificate by changing the values listed below. Make sure to provide the full chain of the certificate in the cert field. - -```yaml -global: - ingress: - certManager: false - wildcard: true - cert: | - -----BEGIN CERTIFICATE----- - - -----END CERTIFICATE----- - -----BEGIN CERTIFICATE----- - - -----END CERTIFICATE----- - ... - - key: | - -----BEGIN RSA PRIVATE KEY----- - - -----END RSA PRIVATE KEY----- ``` - -Refer to [Certificate Management](/docs/configuration/certificate-management) for configuring certificates for the entire solution. - -### Specify different certificates - -If you do not use cert-manager for your cluster, you can specify a certificate for each ingress of this chart. - -It is possible to define a different certificate for each ingress by changing the values listed below. Keep an empty line after the key or the certificate. - -```yaml -global: - ingress: - certManager: false - wildcard: false -anm: - ingressCert: ... - ingressKey: ... -apimgr: - ingressCert: ... - ingressKey: ... -apitraffic: - ingressCert: ... - ingressKey: ... - ingressCertMtls: ... - ingressKeyMtls: ... - ingressCertHttps: ... - ingressKeyHttps: ... +apigateway-config-fdx-7.7.0.20xxxxxx-BNxx +├── PS-Projects +│ └── FDX-YAML #directory containing policy configuration in YAML format +├── README.md +├── merge #merge directory containing API Gateway configuration files +│ ├── apigateway +│ └── mandatoryFiles +└── sample #sample scripts + ├── kps_import.sh #deploy YAML config and merge dir + └── mount_config.sh #import KPS configuration ``` -Insert each cert and key with the following format (same indent and empty lines): +`PS-Projects/FDX-YAML` directory contains the policies created using [YAML configuration](https://docs.axway.com/bundle/axway-open-docs/page/docs/apim_yamles/index.html). -```yaml - ingressCert: | - -----BEGIN CERTIFICATE----- - < insert here base64-encoded certificate > - -----END CERTIFICATE----- - -----BEGIN CERTIFICATE----- - < insert here base64-encoded certificate > - -----END CERTIFICATE----- +### Prepare values.yaml for the deployment - ingressKey: | - -----BEGIN RSA PRIVATE KEY----- - < insert here base64-encoded key > - -----END RSA PRIVATE KEY----- +As some of the variables are defined in `PS-Projects/FDX-YAML/values.yaml` file, you must update it before deployment. it is recommendation to copy the `PS-Projects/FDX-YAML/values.yaml` to `local_values/FDX-YAML/values.yaml` and then make changes in it. +```bash +cp apigateway-config-fdx-7.7.0.20xxxxxx-BNxx/PS-Projects/FDX-YAML/values.yaml local_values/FDX-YAML/values.yaml ``` -{{% alert title="Note" color="primary" %}}The OAuth component is activated but ingress is not enabled. It is not required to create a certificate for this ingress. {{% /alert %}} +The following parameters are required for FDX deployment, so update the `local_values/FDX-YAML/values.yaml` file. -Refer to [Certificate Management](/docs/configuration/certificate-management) for configuring certificates for the entire solution. +| Value | Description | Default value | Example | +|:------------- |:------------------------------------- |:-------------- |:--------| +| Environment_Configuration.Service.ACP_Host.name | Host on which Cloudentity is running. | acp.open-banking-cloudentity | | +| Environment_Configuration.Service.ACP_Host.port | Port where Cloudentity is running. | 8443 | | +| Environment_Configuration.Service.apimgr.name | Endpoint where API Manager is running. | api-manager-host | api-manager.open-banking.axway.com | +| Environment_Configuration.Service.apimgr.port | Post at which API Manager is running. | 443 | | +| Policies._AMPLIFY_OB_FDX.Mock.Login_Page.PAGE_login.Set_var_demo_apps_enabled.attributeValue | Set to `true` if demo-apps are deployed. | false | | +| Policies._AMPLIFY_OB_FDX.Mock.Login_Page.PAGE_login.Set_demo_apps_url.attributeValue | Endpoint where demo apps are running. If not deploying demo apps component then keep the default. | `https://demo-apps.\` | `https://demo-apps.open-banking.axway.com` | -### Defining the number of api traffic replicas +### Mount the FDX Configuration -If it is necessary to adjust the number of API traffic replicas, you can adjust on the following parameters: +Make sure that API Gateway pods (i.e., anm, apimgr, apitraffic) are in running state and then execute the following commands: -| Value | Description | Default value | -|:------------- |:------------------------------------- |:-------------- | -| apitraffic.replicaCount | Number of initial replicas for API traffic. | 3 | -| apitraffic.autoscalling.enable | Enable the autoscaling feature. | true | -| apitraffic.maxreplicas | Maximum number of API traffic replicas. | 5 | - -## Install the APIM Helm chart - -1. Create the target namespace on the cluster: - - ```bash - kubectl create namespace open-banking-apim - ``` - -2. Install the APIM Helm charts: - - ```bash - helm install apim open-banking-fdx-apim -n open-banking-apim - ``` - -3. Check that the status of the Helm command is deployed: - - ```console - NAME: apim - LAST DEPLOYED: - NAMESPACE: open-banking-apim - STATUS: deployed - REVISION: 1 - TEST SUITE: None - ``` - -## Verify the APIM Helm chart deployment - -1. Wait a few minutes and use the following commands to check the deployment status. +```bash +cd apigateway-config-fdx-7.7.0.20xxxxxx-BNxx/sample +./mount_config.sh -p FDX +cd - +``` - ```bash - kubectl get pods -n open-banking-apim - ``` +The above script deploys YAML archive and other configuration files from `merge` directory to `gw-external-config` volume mount in K8S cluster. Before building the YAML archive, it replaces `apigateway-config-fdx-7.7.0.20xxxxxx-BNxx/PS-Projects/FDX-YAML/values.yaml` with `local_values/FDX-YAML/values.yaml`, which contains the actual values for the target environment. -2. Verify that: - * **pods** with name anm-xxx-xxx, apimgr-xxx-xxx, traffic-xxx-xxx, cassandra-0 are **Running** and Restart is **0**. - - ```console - NAME READY STATUS RESTARTS - anm-6d86b7dfbd-4wbnx 1/1 Running 0 - apimgr-544b55fffb-qsn87 1/1 Running 0 - cassandra-0 1/1 Running 0 - traffic-5d986c7d55-cv6dv 1/1 Running 0 - ``` +## Configure API Manager -3. Check all ingress with this command: +To configure API Manager (i.e., to create Organizations, APIs, applications and import KPS data), use the `open-banking-fdx-apim-config` helm chart. During installation it creates Organizations, sample applications and FDX APIs. It also imports data in the KPS tables. - ```bash - kubectl get ingress -n open-banking-apim - ``` +### Change apiadmin user password -4. Verify that these ingress are provisioned. They must have a public ip or a dns value in the ADDRESS column. +Log in to the API Manager UI to change the default password of `apiadmin` user. It is required for successful execution of the below steps. - ```console - NAME HOSTS ADDRESS PORTS - apimanager api-manager. xxxxxxxxxxxxx.amazonaws.com 80, 443 - gatewaymanager api-gateway-manager. xxxxxxxxxxxxx.amazonaws.com 80, 443 - oauth oauth. xxxxxxxxxxxxx.amazonaws.com 80, 443 - traffic api. xxxxxxxxxxxxx.amazonaws.com 80, 443 - traffichttps services-api. xxxxxxxxxxxxx.amazonaws.com 80, 443 - trafficmtls mtls-api. xxxxxxxxxxxxx.amazonaws.com 80, 443 - ``` -5. Check that you can access the following user interfaces: - * *API Gateway Manager* `https://api-gateway-manager.`. +### Fetch the Helm chart to examine the values file - * Login with username *admin* and password set during deployment. - * Check in the topology section that apimgr and traffic pods are available. +Run a `helm fetch` command on the added repository to view the Helm `values.yaml` file: - * *API Manager* `https://api-manager.`. +```bash +helm fetch axway/open-banking-fdx-apim-config --untar +``` - * Login with username *apiadmin* and initial password. you will be prompted to change the password on first login. - * Check that API and Client configurations are empty for now. +This command creates a directory `open-banking-fdx-apim-config` containing the complete chart, including the `values.yaml` file. -## Customize the APIM configuration Helm chart +### Customize the APIM configuration Helm chart Customize the `open-banking-fdx-apim-config/values.yaml` file as follows. | Value | Description | Default value | |:------------- |:------------------------------------- |:-------------- | | global.domainName | Set the domainname for all ingress. | None | -| global.env | Set the default environment. |dev | +| global.env | Set the default environment. | prod | +| global.dockerRegistry.url | URL for the docker registry. | None | | global.dockerRegistry.username | Login name to pull Docker images from the Axway Repository. | None | | global.dockerRegistry.token | Password token to pull Docker images from the Axway Repository. | None | -| apimcli.language | The language used to describe the APIs on API Manager. | en-EN | | anm.admin.username | API Gateway admin username | admin | | anm.admin.password | API Gateway admin password | | | apimgr.admin.username | API Manager admin username | apiadmin | | apimgr.admin.password | API Manager admin password | | -| apimcli.settings.email | Sender email address used in api-manager settings. | None | -| demoapp.bankio.clientId | The bankio demo apps client id. | None | -| demoapp.postman.clientId | The postman client id. |None| +| demoapp.bankio.clientId | The bankio demo apps client id. | bankio | +| demoapp.postman.clientId | The postman client id. | postman | -## Install the APIM configuration Helm chart +### Install the APIM configuration Helm chart 1. Run the following command to install the APIM config Helm chart: @@ -275,17 +114,17 @@ Customize the `open-banking-fdx-apim-config/values.yaml` file as follows. ``` NAME: apim-config LAST DEPLOYED: - NAMESPACE: open-banking-config + NAMESPACE: open-banking-apim STATUS: deployed REVISION: 1 TEST SUITE: None ``` -## Verify the APIM configuration Helm chart deployment +### Verify the APIM configuration Helm chart deployment 1. Wait a few minutes and use the following commands to check the deployment status. - ``` + ```bash kubectl get pods -n open-banking-apim ``` @@ -295,120 +134,38 @@ Customize the `open-banking-fdx-apim-config/values.yaml` file as follows. ``` NAME READY STATUS RESTARTS anm-6d86b7dfbd-4wbnx 1/1 Running 0 - apimgr-544b55fffb-qsn87 1/1 Running 0 - cassandra-0 1/1 Running 0 + apimgr-544b55fffb-qsn87 1/1 Running 0 import-api-27983c3f-... 0/1 Completed 0 traffic-5d986c7d55-cv6dv 1/1 Running 0 ``` 3. Check API Manager `https://api-manager.`: - * Refresh or login again. + * Refresh or log in again. * Make sure that Open Banking APIs are in the API Catalog. * Make sure that Default apps are in Client applications. +4. Check KPS data in API Gateway Manager `https://api-gateway-manager.`: + * Log in and go to *Settings - Key Property Stores*. + * Make sure that `Configuration` and `Error` tables are not emplty. + ## Post deployment -Once the APIM and [Cloudentity](/docs/deployment/installation/cloudentity) Helm charts are deployed, update the KPS configuration as follows to integrate the components together. +This post deployment step is only applicable if you have changed the default ports, client ids, client secrets, etc. during the [Cloudentity](/docs/deployment/installation/cloudentity/acp) or [Consent Apps](/docs/deployment/installation/cloudentity/consent-apps) deployment. ### Update KPS configuration -You need to import some configurations in the Key Properties Store (KPS). They are used in policies for consent flows. - -1. Get the KPS configuration and error table data files from the helmchart: - * Configuration Table KPS data file is `open-banking-apim-config/files/kps/amplify_configuration.json` - * Error Table KPS data file is `open-banking-apim-config/files/kps/amplify_error.json` - -2. You can use the below sample script to import data in KPS. - - ```shell - #!/bin/bash - - function usage { - echo "NAME" - echo " ./loadKPS.sh" - echo "" - echo "SYNOPSIS" - echo " loadKPS.sh -a -i -f -t -u -p " - echo "" - echo " -h : Display usage." - echo "" - echo "EXAMPLE" - echo " loadKPS.sh -a api-gateway-manager. -i traffic-5dbc49dfd8-6mdnt -f amplify_configuration.json -t cfg -u admin -p password" - echo " loadKPS.sh -a api-gateway-manager. -i traffic-5dbc49dfd8-6mdnt -f amplify_error.json -t err -u admin -p password" - echo "" - exit 1 - } - - ##################################### - # M A I N # - ##################################### - while getopts a:i:f:t:u:p:h opt; do - case $opt in - a) ANM=${OPTARG} ;; - i) INSTANCE=${OPTARG} ;; - f) FILE=${OPTARG} ;; - t) TABLEALIAS=${OPTARG} ;; - u) USERNAME=${OPTARG} ;; - p) PASSWORD=${OPTARG} ;; - h) usage; exit ;; - :) echo "[ERROR] -${opt} requires an argument." - usage; exit 1 ;; - *) usage; exit 1 ;; - esac - done - - if [[ $# -eq 0 || $1 == "-h" ]] - then - usage - exit 1 - fi - - if [[ -z "${ANM}" ]]; then - echo "Please provide the target ANM host name to -a" - echo "Stopping now." - exit 1 - fi - - if [[ -z "${INSTANCE}" ]]; then - echo "Please provide the instance id with -i" - echo "Stopping now." - exit 1 - fi - - if [[ -z "${FILE}" ]]; then - echo "Please provide the KPS data file with -f" - echo "Stopping now." - exit 1 - fi - - if [[ -z "${USERNAME}" ]]; then - echo "Please provide the ANM username with -u" - echo "Stopping now." - exit 1 - fi - - if [[ -z "${PASSWORD}" ]]; then - echo "Please provide the ANM password with -p" - echo "Stopping now." - exit 1 - fi - - if [[ -z "${TABLEALIAS}" ]]; then - echo "Please provide the KPS table alias with -t" - echo "Stopping now." - exit 1 - fi - - jq -c '.[]' ${FILE} | while read i; do - id=`echo $i | jq --raw-output '.a_id'` - echo "$id" - curl -k --location --request PUT https://${ANM}/api/router/service/${INSTANCE}/api/kps/${TABLEALIAS}/${id} -u "${USERNAME}:${PASSWORD}" --header 'Content-Type: application/json' --data-raw $i - echo "=================================================" - done +To update configurations in the `cfg` KPS table: + +1. Get the KPS configuration table data file from the Helm chart: + * Configuration table KPS data file is `open-banking-fdx-apim-config/files/kps/amplify_configuration.json`. + * Update it with the values specific to your deployment. +2. You can use the sample script `kps_import.sh` provided in `apigateway-config-fdx-7.7.0.20xxxxxx-BNxx.tar.gz` package to import data in KPS. Example usage is: + + ```bash + kps_import.sh -a api-gateway-manager. -i traffic-5dbc49dfd8-6mdnt -f amplify_configuration.json -t cfg -u admin -p password" ``` 3. Verify the insertion in the KPS table: - * Log into the API Gateway Manager UI and go on Settings - Key Property Stores. - * Click on AMPLIFY/Configuration and make sure that data exist in it. - * Click on AMPLIFY/Error and make sure that data exist in it. + * Log in to the API Gateway Manager UI and go to *Settings - Key Property Stores*. + * Click on AMPLIFY/Configuration and make sure that the data is updated. diff --git a/content/en/docs/deployment/installation/API-Management/obb-apim.md b/content/en/docs/deployment/installation/API-Management/obb-apim.md index 53447194..0f44a76d 100644 --- a/content/en/docs/deployment/installation/API-Management/obb-apim.md +++ b/content/en/docs/deployment/installation/API-Management/obb-apim.md @@ -1,293 +1,96 @@ --- -title: "Open Finance Brazil API Management Installation" +title: "Open Finance Brazil API Management Configuration" linkTitle: "Open Finance Brazil API Management" weight: 2 --- -## Customize the APIM Helm chart +## Configure API Gateway -Customize the `open-banking-apim/values.yaml` file as follows. +Once the installation is complete following the instructions at [Install API Gateway using your customized YAML file](https://docs.axway.com/bundle/axway-open-docs/page/docs/apim_installation/apigw_containers/deployment_flows/axway_image_deployment/helm_deployment/index.html#install-api-gateway-using-your-customized-yaml-file), mount the FDX policies and configuration files using the below steps. -### Base parameters +### Download the API Gateway configuration files -The following parameters are required for any deployment. +To download the Amplify Open Banking API Management configuration package for OBB deployment, go to [Axway Repository](https://repository.axway.com/) and search for “Amplify Open Banking.” Check the `Utility` box and download the `apigateway-config-obb-7.7.0.20xxxxxx-BNxx.tar.gz` file. -| Value | Description | Default value | -|:------------- |:------------------------------------- |:-------------- | -| global.platform | Select the platform to configure appropriate objects (like storage for RWM).
    Possible values are AWS, AZURE, MINIKUBE. | None | -| global.domainName | Set the domainname for all ingress. | None | -| global.env | Set the default environment. | dev | -| global.dockerRegistry.username | Login name to pull Docker images from the Axway Repository. | None | -| global.dockerRegistry.token | Password token to pull Docker images from the Axway Repository. | None | -| global.denyDemoLogin | Disables the demo login idp. It should be disabled on the customer environment. | false | -| global.smtpServer.host | Smtp server host. | None | -| global.smtpServer.port | Smtp server port. | None | -| global.smtpServer.username | Smtp server username. | None | -| global.smtpServer.password | Smtp server password. | None | -| global.smtpServer.protocol | Smtp server protocol as SSL, TLS, or None. | None | - - - -With these base parameters set, you can install the Helm chart. See [Install the APIM Helm chart](#install-the-apim-helm-chart). - -This deployment uses cert-manager and the [Let's Encrypt](https://letsencrypt.org) issuer to provide certificates. This requires an ingress controller (nginx) that listens on a public IP. You must replace the certificates provided with the sample Helm chart with your own certificates. - -You can also customize the chart values with the following sub-sections. - -### Product license - -A temporary license file is embedded in the default Docker image. - -This license key has a lifetime to two months maximum. - -This license is perfect for a demo or a proof of concept but another license key must be added for production environments. - -| Value | Description | Default value | -|:------------- |:------------------------------------- |:-------------- | -| global.apimLicense | Insert your license key. An example is in the default value file. | None | - -### External Cassandra - -According to the reference architecture, the Cassandra database is external to the cluster. Change the following values according to the cassandra configuration. +After the download is finished, extract the archive's contents: -The Helm chart is delivered with an internal cassandra database that would work for non-production environments. You can change this parameter to use an external one. A Cassandra environment is required for production environments at minimum. - -```yaml -cassandra: - external: true - adminName: "cassandra" - adminPasswd: "cassandra" - host1: "cassandra" - host2: "cassandra" - host3: "cassandra" +```bash +tar -xzf apigateway-config-obb-7.7.0.20xxxxxx-BNxx.tar.gz ``` -Refer to the [Administer Apache Cassandra](https://docs.axway.com/bundle/axway-open-docs/page/docs/cass_admin/index.html) in the API Management documentation to configure and manage the Apache Cassandra database for API Gateway and API Manager. - -### Root CA for MTLS clients - -Optionally, you can add a new root CA for MTLS ingress during the first deployment. - -The mutual authentication is provided by Nginx. It requires a Kubernetes secret that contains all rootCA used for client certificates (used by TPPs). - -The different root CA certificates must be concatenated and encoded in base64. - -| Value | Description | Default value | -|:------------- |:------------------------------------- |:-------------- | -| apitraffic.ingressMtlsRootCa | All concatenated root CA encoded in base64. | yes | - -### Customize storage class - -Only if needed, you can change the storage class. +This command creates a directory `apigateway-config-obb-7.7.0.20xxxxxx-BNxx` containing the following sub-directories and files: -The APIM deployment needs a storage class in Read/Write Many. A custom storage class can be set if the cluster does not use the standard deployment for Azure, AWS, or if the deployment is on a vanilla Kubernetes. - -| Value | Description | Default value | -|:------------- |:------------------------------------- |:-------------- | -| Global.customStorageClass.scrwm | Allow to specify a storage class to mount a “Read Write Many” volume on pod.
    It is used to share metrics between monitoring and analytics. | None | - -### Specify a Wildcard certificate - -If you do not use cert-manager for your cluster, you can specify a unique certificate for all ingress of this chart. - -It is possible to use a custom wildcard certificate by changing the values listed below. Make sure to provide the full chain of the certificate in the cert field. - -```yaml -global: - ingress: - certManager: false - wildcard: true - cert: | - -----BEGIN CERTIFICATE----- - - -----END CERTIFICATE----- - -----BEGIN CERTIFICATE----- - - -----END CERTIFICATE----- - ... - - key: | - -----BEGIN RSA PRIVATE KEY----- - - -----END RSA PRIVATE KEY----- ``` - -Refer to [Certificate Management](/docs/configuration/certificate-management) for configuring certificates for the entire solution. - -### Specify different certificates - -If you do not use cert-manager for your cluster, you can specify a certificate for each ingress of this chart. - -It is possible to define a different certificate for each ingress by changing the values listed below. Keep an empty line after the key or the certificate. - -```yaml -global: - ingress: - certManager: false - wildcard: false -anm: - ingressCert: ... - ingressKey: ... -apimgr: - ingressCert: ... - ingressKey: ... -apitraffic: - ingressCert: ... - ingressKey: ... - ingressCertMtls: ... - ingressKeyMtls: ... - ingressCertHttps: ... - ingressKeyHttps: ... +apigateway-config-obb-7.7.0.20xxxxxx-BNxx +├── PS-Projects +│ └── OBB-YAML #directory containing policy configuration in YAML format +├── README.md +├── merge #merge directory containing API Gateway configuration files +│ ├── apigateway +│ └── mandatoryFiles +└── sample #sample scripts + └── mount_config.sh #import KPS configuration ``` -Insert each cert and key with the following format (same indent and empty lines): +`PS-Projects/OBB-YAML` directory contains the policies created using [YAML configuration](https://docs.axway.com/bundle/axway-open-docs/page/docs/apim_yamles/index.html). -```yaml - ingressCert: | - -----BEGIN CERTIFICATE----- - < insert here base64-encoded certificate > - -----END CERTIFICATE----- - -----BEGIN CERTIFICATE----- - < insert here base64-encoded certificate > - -----END CERTIFICATE----- +### Prepare values.yaml for the deployment - ingressKey: | - -----BEGIN RSA PRIVATE KEY----- - < insert here base64-encoded key > - -----END RSA PRIVATE KEY----- +As some of the variables are defined in the `PS-Projects/OBB-YAML/values.yaml` file, you must update it before deployment. It is recommended to copy the `PS-Projects/OBB-YAML/values.yaml` to `local_values/OBB-YAML/values.yaml` and then make changes in it. +```bash +cp apigateway-config-obb-7.7.0.20xxxxxx-BNxx/PS-Projects/OBB-YAML/values.yaml local_values/OBB-YAML/values.yaml ``` -{{% alert title="Note" color="primary" %}}The Oauth component is activated but ingress is not enabled. It is not required to create a certificate for this ingress. {{% /alert %}} - -Refer to [Certificate Management](/docs/configuration/certificate-management) for configuring certificates for the entire solution. +### Mount the OBB Configuration -### Defining the number of api traffic replicas - -If it is necessary to adjust the number of API traffic replicas, you can adjust on the following parameters: - -| Value | Description | Default value | -|:------------- |:------------------------------------- |:-------------- | -| apitraffic.replicaCount | Number of initial replicas for API traffic. | 3 | -| apitraffic.autoscalling.enable | Enable the autoscaling feature. | true | -| apitraffic.maxreplicas | Maximum number of API traffic replicas. | 5 | +Make sure that API Gateway pods (i.e. anm, apimgr, apitraffic) are in running state and then execute the following commands: -### Defining the information required for Open Banking Brazil - -There are some specific information related to Open Banking Brazil for each institution. And it can be defined here: - -| Value | Description | Default value | -|:------------- |:------------------------------------- |:-------------- | -| bank.jwtsign.cert | Certificate of the bank used to sign the JWT. | None | -| bank.jwtsign.key | Private key of the bank used to sign the JWT. | None | -| bank.jwtkid | Bank certificate identification (JWKID). | None | - -## Install the APIM Helm chart - -1. Create the target namespace on the cluster: - - ```bash - kubectl create namespace open-banking-apim - ``` - -2. Install the APIM Helm charts: - - ```bash - helm install apim open-banking-apim -n open-banking-apim - ``` - -3. Check that the status of the Helm command is deployed: - - ```console - NAME: apim - LAST DEPLOYED: - NAMESPACE: open-banking-apim - STATUS: deployed - REVISION: 1 - TEST SUITE: None - ``` - -## Verify the APIM Helm chart deployment - -1. Wait a few minutes and use the following commands to check the deployment status. +```bash +cd apigateway-config-obb-7.7.0.20xxxxxx-BNxx/sample +./mount_config.sh -p OBB +cd - +``` - ```bash - kubectl get pods -n open-banking-apim - ``` +The above script deploys YAML archive and other configuration files from `merge` directory to `gw-external-config` volume mount in K8S cluster. Before building the YAML archive it replaces `apigateway-config-obb-7.7.0.20xxxxxx-BNxx/PS-Projects/OBB-YAML/values.yaml` with `local_values/OBB-YAML/values.yaml`, which contains the actual values for the target environment. -2. Verify that: - * **pods** with name anm-xxx-xxx, apimgr-xxx-xxx, traffic-xxx-xxx, cassandra-0 are **Running** and Restart is **0**. - * **jobs** with name db-create-mysql-apigw-xxx is **Completed**. - - ```console - NAME READY STATUS RESTARTS - anm-6d86b7dfbd-4wbnx 1/1 Running 0 - apimgr-544b55fffb-qsn87 1/1 Running 0 - cassandra-0 1/1 Running 0 - db-create-mysql-apigw-379e224c-... 0/1 Completed 0 - filebeat-analytics-86d588954b-lsx2p 1/1 Running 0 - mysql-aga-757495f88f-vpw79 1/1 Running 0 - traffic-5d986c7d55-cv6dv 1/1 Running 0 - ``` +## Configure API Manager -3. Check all ingress with this command: +To configure API Manager (i.e. to create Organizations, APIs, applications and import KPS data), use the `open-banking-apim-config` helm chart. During installation it creates Organizations, sample applications and OBB APIs. It also imports data in the KPS tables. - ```bash - kubectl get ingress -n open-banking-apim - ``` +### Change apiadmin user password -4. Verify that these ingress are provisioned. They must have a public ip or a dns value in the ADDRESS column. +Log in to the API Manager UI to change the default password of `apiadmin` user. It is required for the successful execution of the below steps. - ```console - NAME HOSTS ADDRESS PORTS - apimanager api-manager. xxxxxxxxxxxxx.amazonaws.com 80, 443 - gatewaymanager api-gateway-manager. xxxxxxxxxxxxx.amazonaws.com 80, 443 - oauth oauth. xxxxxxxxxxxxx.amazonaws.com 80, 443 - traffic api. xxxxxxxxxxxxx.amazonaws.com 80, 443 - traffichttps services-api. xxxxxxxxxxxxx.amazonaws.com 80, 443 - trafficmtls mtls-api. xxxxxxxxxxxxx.amazonaws.com 80, 443 - ``` -5. Check that you can access the following user interfaces: - * *API Gateway Manager* `https://api-gateway-manager.`. +### Fetch the Helm chart to examine the values file - * Login with username *admin* and password *apiAdminPwd!* - * Check in the topology section that apimgr and traffic pods are available. +Run a `helm fetch` command on the added repository to view the Helm `values.yaml` file: - * *API Manager* `https://api-manager.`. +```bash +helm fetch axway/open-banking-apim-config --untar +``` - * Login with username *apiadmin* and password *apiAdminPwd!* - * Check that API and Client configurations are empty for now. +This command creates a directory `open-banking-apim-config` containing the complete chart, including the `values.yaml` file. -## Customize the APIM configuration Helm chart +### Customize the APIM configuration Helm chart -Customize the `open-banking-apim-config/values.yaml` file as follows. +Customize the `open-banking-apim-config/values.yaml` file as follows: | Value | Description | Default value | |:------------- |:------------------------------------- |:-------------- | | global.domainName | Set the domainname for all ingress. | None | -| global.env | Set the default environment. |dev | +| global.env | Set the default environment. | prod | +| global.dockerRegistry.url | URL for the docker registry. | None | | global.dockerRegistry.username | Login name to pull Docker images from the Axway Repository. | None | | global.dockerRegistry.token | Password token to pull Docker images from the Axway Repository. | None | -| apimcli.language | The language used to describe the APIs on API Manager. | pt-BR | -| apimcli.settings.email | Sender email address used in api-manager settings. | None | -| apimcli.users.publicApiUser | Username of user to access the Public APIs from the API Portal. | *publicuser* | -| apimcli.users.publicApiPassword | Password of user to access the Public APIs from the API Portal. | *publicUserPwd!* | -| backend.serviceincident.host | ServiceNow URL. | None| -| backend.serviceincident.username | ServiceNow username. |None| -| demoapp.bankio.clientId | The bankio client id. | None | -| demoapp.postman.clientId | The postman client id. |None| +| anm.admin.username | API Gateway admin username. | admin | +| anm.admin.password | API Gateway admin password. | | +| apimgr.admin.username | API Manager admin username. | apiadmin | +| apimgr.admin.password | API Manager admin password. | | +| demoapp.bankio.clientId | The bankio demo apps client id. | bankio | +| demoapp.postman.clientId | The postman client id. | postman | -## Install the APIM configuration Helm chart +### Install the APIM configuration Helm chart 1. Run the following command to install the APIM config Helm chart: @@ -300,17 +103,17 @@ Customize the `open-banking-apim-config/values.yaml` file as follows. ``` NAME: apim-config LAST DEPLOYED: - NAMESPACE: open-banking-config + NAMESPACE: open-banking-apim STATUS: deployed REVISION: 1 TEST SUITE: None ``` -## Verify the APIM configuration Helm chart deployment +### Verify the APIM configuration Helm chart deployment -1. Wait a few minutes and use the following commands to check the deployment status. +1. Wait a few minutes and use the following commands to check the deployment status: - ``` + ```bash kubectl get pods -n open-banking-apim ``` @@ -320,51 +123,43 @@ Customize the `open-banking-apim-config/values.yaml` file as follows. ``` NAME READY STATUS RESTARTS anm-6d86b7dfbd-4wbnx 1/1 Running 0 - apimgr-544b55fffb-qsn87 1/1 Running 0 - cassandra-0 1/1 Running 0 - db-create-mysql-apigw-379e224c-... 0/1 Completed 0 - filebeat-analytics-86d588954b-lsx2p 1/1 Running 0 - import-api-27983c3f-... 0/1 Completed 0 - mysql-aga-757495f88f-vpw79 1/1 Running 0 + apimgr-544b55fffb-qsn87 1/1 Running 0 + import-api-27983c3f-... 0/1 Completed 0 traffic-5d986c7d55-cv6dv 1/1 Running 0 ``` 3. Check API Manager `https://api-manager.`: - * Refresh or login again. + * Refresh or log in again. * Make sure that Open Banking APIs are in the API Catalog. * Make sure that Default apps are in Client applications. ## Post deployment -Once the APIM and [Cloudentity](/docs/deployment/installation/cloudentity) Helm charts are deployed, update the KPS configuration as follows to integrate the components together. - ### Update KPS configuration -You need to import some configurations in the Key Properties Store (KPS). They are used in policies for consent flows. - -1. To change the KPS: - * The organization ID is different for each bank. Modify the Helm chart file `open-banking-apim-config/files/kps/kpsConfig1.json` to change the organizationId with your own bank/PSPSP ID. - * Execute the following command: - - ```shell - APIMGR_POD="$(kubectl get pod -n open-banking-apim -l app=apimgr -o jsonpath='{.items[0].metadata.name}')" - ANM_INGRESS_NAME="$(kubectl get ingress -n open-banking-apim gatewaymanager -o jsonpath='{.spec.rules[0].host}')" - # check variables APIMGR_POD and ANM_INGRESS_NAME are not empty - echo $APIMGR_POD : $ANM_INGRESS_NAME - ANM_USERNAME=admin - ANM_PASSWORD='apiAdminPwd!' - curl -k -X PUT -u "$ANM_USERNAME:$ANM_PASSWORD" \ - -H "Content-Type: application/json" \ - -d @open-banking-apim-config/files/kps/kpsConfig1.json \ - "https://${ANM_INGRESS_NAME}:443/api/router/service/${APIMGR_POD}/api/kps/cfg/1" - awk -F '\t' '{ \ - if ($5==Y) {$5="true"} else {$5="false"}; \ - print "Create id"$1; \ - system("curl -k -X PUT -u \"'"${ANM_USERNAME}"':'"${ANM_PASSWORD}"'\" -H \"Content-Type: application/json\" 'https://${ANM_INGRESS_NAME}:443'/api/router/service/'${APIMGR_POD}'/api/kps/'mediciobie_endpoint'/"$1" -d '\''{\"id\":\""$1"\",\"category\":\""$2"\",\"name\":\""$3"\",\"segment\":\""$4"\",\"used\":"$5"}'\''")}' \ - "open-banking-apim-config/files/kps/obie_endpoint.txt" - ``` +Fetch the new kps-config module + +```bash +helm fetch axway/open-banking-obb-kps-config --untar +``` + +This command creates a directory `open-banking-obb-kps-config` containing the complete chart, including the `values.yaml` file. -2. Verify the insertion in the KPS table: - * Log into the API Gateway Manager UI and go on Settings - Key Property Stores. - * Click on AMPLIFY/Configuration. - * Check that the column **k_values** is not empty. Click on it to check the details. +### Customize the KPS Config Helm chart + +Customize the `open-banking-obb-kps-config/values.yaml` file as follows. + +| Value | Description | Default value | +|:------------- |:------------------------------------- |:-------------- | +| gateway.user | The Gateway Manager user. | `admin` | +| gateway.password | The Gateway manager password. | `changeme` | +| gateway.name | The deployment name. | `open-banking-gateway` | +| gateway.ingress | The Gateway Manager URL. | `api-gateway-manager.` | +| gateway.apimPodName | APIM Pod name. | `apim-apimanager-` | +| kps.env.config | KPS Configuration | Typically won't change | + +Verify the insertion in the KPS table: + +* Log into the API Gateway Manager UI and go to *Settings - Key Property Stores*. +* Click on AMPLIFY/Configuration. +* Check that the table is not empty. Click on table rows to chech details. diff --git a/content/en/docs/deployment/installation/Cloudentity/_index.md b/content/en/docs/deployment/installation/Cloudentity/_index.md index cf4fb1ac..adfc4444 100644 --- a/content/en/docs/deployment/installation/Cloudentity/_index.md +++ b/content/en/docs/deployment/installation/Cloudentity/_index.md @@ -4,33 +4,24 @@ linkTitle: "Cloudentity" weight: 20 --- -Install Cloudentity for the Amplify Open Banking solution. Cloudentity includes 2 components: +Install Cloudentity for the Amplify Open Banking solution. Cloudentity component provides Identity and Access Management along with consent management. + +Cloudentity includes 2 components: * Cloudentity * Sample Consent Applications {{% alert title="Note" color="primary" %}} Sample Consent applications are not developed for production usage. For more information please see deatils in [Component View](/docs/overview/technical/component).{{% /alert %}} -## Download the Cloudentity Helm charts - -Download the Amplify Open Banking Cloudentity Helm charts to customize them locally. - -### Financial Data Exchange (FDX) - -```bash -helm pull axway/open-banking-fdx-acp --untar -helm pull axway/open-banking-fdx-consent-apps --untar -``` - -You should get `open-banking-fdx-acp` and `open-banking-fdx-consent-apps` local folders. +## Fetch the Cloudentity Helm charts -### Open Finance Brazil +Fetch the Amplify Open Banking Cloudentity Helm charts to view the `values.yaml` file. ```bash -helm pull axway/open-banking-acp --untar -helm pull axway/open-banking-consent --untar +helm fetch axway/open-banking-cloudentity --untar +helm fetch axway/open-banking-consent-apps --untar ``` -You should get `open-banking-acp` and `open-banking-consent` local folders. +You should get `open-banking-cloudentity` and `open-banking-consent-apps` local folders. For each component, follow the instructions in the subsections below. diff --git a/content/en/docs/deployment/installation/Cloudentity/acp.md b/content/en/docs/deployment/installation/Cloudentity/acp.md index 0b93f876..5f1d93bf 100644 --- a/content/en/docs/deployment/installation/Cloudentity/acp.md +++ b/content/en/docs/deployment/installation/Cloudentity/acp.md @@ -6,7 +6,7 @@ weight: 1 Install Cloudentity for the Amplify Open Banking solution. -## Customize the ACP Helm chart +## Create a customized values.yaml file Find the namespace of the cert-manager component. @@ -14,27 +14,33 @@ Find the namespace of the cert-manager component. kubectl get pods -A | grep cert-manager | awk '{print $1}' | uniq ``` -Modify the `open-banking-fdx-acp/values.yaml` file for FDX deployment and `open-banking-acp/values.yaml` file for Open Finance Brazil deployment. +Create a customized `values` file, for example, `myvalues.yaml`, and make your customizations. This file should contain only the sections of the `values.yaml` file that you wish to override. Any values not present in the customized file will be picked up from the original `values.yaml` file. | Value | Description | Default value | |:------------- |:------------------------------------- |:-------------- | | global.dockerRegistry.username | Defining Cloudentity repository username. | None | | global.dockerRegistry.password | Defining Cloudentity repository password. | None | -| redis-cluster.password | Defining Cloudentity's Redis password. | None | | acp-prereq.cert.internal.certManager | Define if cert-manager is used internally.
    False is currently not supported. | true | | acp-prereq.cert.internal.certManagerNamespace | Namespace where cert-manager is installed. Use the result of the previous command. | None | | acp-prereq.cert.ingress.certManager | Define if cert-manager is used externally.
    If set to false, define cert and keys with values below. | true | | acp-prereq.cert.ingress.cert | Use specific cert. It can be a wildcard. Must be defined only if certManager is set to false. | None | | acp-prereq.cert.ingress.key | Use specific key. It can be a wildcard. Must be defined only if certManager is set to false. | None | -| acp.serverURL | Cloudentity server URL | None | -| acp.serverURLMtls | Cloudentity server URL | None | -| acp.config.data.storage.audit_events.retention.enabled | Enable audit events retention | true | -| acp.config.data.storage.audit_events.retention.batch_limit | Audit events retention batch delete limit | 1000 | -| acp.config.data.storage.audit_events.retention.max_age | Remove audit events older than max age limit | 6h0m0s | -| acp.config.data.server.obbr_base_paths | Open banking Brasil API base path whitelist. | None | -| acp.ingress.hosts.host | Cloudentity server URL | None | -| acp.ingress.customAnnotations.nginx.ingress.kubernetes.io/proxy-ssl-secret | Secret to keep the ssl cert. It should be [NAMESPACE]/acp-tls | open-banking-acp/acp-tls | +| acp-prereq.cert.ingress.certMtls | Use specific cert for Cloudentity mtls endpoint. It can be a wildcard. Must be defined only if certManager is set to false. | None | +| acp-prereq.cert.ingress.keyMtls | Use specific key for Cloudentity mtls endpoint. It can be a wildcard. Must be defined only if certManager is set to false. | None | +| acp.serverURL | Cloudentity admin server URL. | None | +| acp.serverURLMtls | Cloudentity mtls server URL. | None | +| acp.secretConfig.data.redis.password | redis password. | None | +| acp.ingress.tls.hosts | Cloudentity admin server URL. | None | +| acp.ingress.hosts.host | Cloudentity admin server URL. | None | +| acp.ingressMtls.tls.hosts | Cloudentity mtls server URL. | None | +| acp.ingressMtls.hosts.host | Cloudentity mtls server URL. | None | | acp.features.swagger_ui | Enable swagger UI. | true | +| acp.features.fdx_dcr | Enable FDX DCR endpoint. | true | +| acp.config.data.storage.audit_events.retention.enabled | Enable audit events retention. | true | +| acp.config.data.storage.audit_events.retention.batch_limit | Audit events retention batch delete limit. | 1000 | +| acp.config.data.storage.audit_events.retention.max_age | Remove audit events older than max age limit. | 6h0m0s | +| acp.config.data.server.obbr_base_paths | Open banking Brasil API base path whitelist. | None | +| redis-cluster.password | Defining Cloudentity's Redis password. | None | Remove the following lines if cert-manager is not used for ingress: @@ -45,31 +51,17 @@ cert-manager.io/acme-challenge-type: http01 (l23) ## Prepare deployment -1. Add the Cloud Entity Helm repository: - - ```bash - helm repo add cloudentity https://charts.cloudentity.io - helm repo update - ``` - -2. Create the target namespace on the cluster: - - ```bash - kubectl create namespace open-banking-acp - ``` +Create the target namespace on the cluster: -## Install the ACP Helm chart +```bash +kubectl create namespace open-banking-cloudentity +``` -1. Deploy the ACP Helm chart from the CloudEntity repository: - {{% alert title="Note" color="primary" %}}Find the ACP chart-version to use in the `open-banking-acp/README.md`. Otherwise use the latest.{{% /alert %}} +## Install the Cloudentity Helm chart - For FDX: - ```bash - helm install acp -n open-banking-acp ./open-banking-fdx-acp - ``` - For Open Finance Brazil: +1. Deploy the Cloudentity Helm chart: ```bash - helm install acp -n open-banking-acp ./open-banking-acp + helm install acp -n open-banking-cloudentity -f myvalues.yaml axway/open-banking-cloudentity ``` 2. Check that the status of the Helm command is deployed: @@ -77,57 +69,46 @@ cert-manager.io/acme-challenge-type: http01 (l23) ``` NAME: acp LAST DEPLOYED: - NAMESPACE: open-banking-acp + NAMESPACE: open-banking-cloudentity STATUS: deployed REVISION: 1 TEST SUITE: None ``` -## Verify the ACP Helm chart deployment +## Verify the Cloudentity Helm chart deployment 1. Wait a few minutes and use the following commands to check the deployment status. ``` - kubectl get pods -n open-banking-acp + kubectl get pods -n open-banking-cloudentity ``` 2. Verify that: - * **pods** with acp-xxx-xxx, name acp-cockroachdb-x, acp-redis-master-x, acp-redis-replicas-x are all **Running** and Restart is **0**. - * **pods** with acp-cockroachdb-init-xxx is **Completed** and Restart is **0**. + * **pods** with acp-xxx-xxx, name acp-cockroachdb-xxx, acp-redis-cluster-x are all **Running**. + * **pods** with acp-cockroachdb-init-xxx is **Completed**. ``` NAME READY STATUS RESTARTS AGE acp-66d8797fb4-njbw6 1/1 Running 0 3m acp-cockroachdb-0 1/1 Running 0 3m acp-cockroachdb-init-h8hdc 0/1 Completed 0 3m - acp-redis-master-0 1/1 Running 0 3m - acp-redis-replicas-0 1/1 Running 0 3m - acp-redis-replicas-1 1/1 Running 0 3m - acp-redis-replicas-2 1/1 Running 0 3m + acp-redis-cluster-0 1/1 Running 0 3m + acp-redis-cluster-1 1/1 Running 0 3m + acp-redis-cluster-2 1/1 Running 0 3m ``` 3. Check ingress with this command: ```bash - kubectl get ingress -n open-banking-acp + kubectl get ingress -n open-banking-cloudentity ``` 4. Verify that this ingress is provisioned. It must have a public ip or a dns value in the ADDRESS column. ``` NAME HOSTS ADDRESS PORTS AGE - acp acp. xxxxxxxxxxxxx.amazonaws.com 80, 443 2m + acp acp-admin. xxxxxxxxxxxxx.amazonaws.com 80, 443 2m + acp-mtls acp. xxxxxxxxxxxxx.amazonaws.com 80, 443 2m ``` -5. Connect to `https://acp.` with admin / admin and change the password immediately. - -6. Check that you see an "openbanking" workspace. - -## Post Deployment - -* Update the APIM KPS deployment values using the instructions in [APIM Management Installation - Post Deployment](/docs/deployment/installation/api-management/obb-apim/#update-kps-configuration) file to reflect all oauth*clientId and oauth*clientSecret values as deployed in ACP. - -* Navigate to Openbanking workspace, Settings - Authorization - Trusted client certificates, and update the Trusted client certificates content with the `open-banking-consent/files/cert.pem` file attached. - -* Navigate to Openbanking workspace, Applications - Bank - OAuth - Subject Distinguished Name, update with the following entry -`CN=cid2.authorization.cloudentity.com,OU=Authorization,O=Cloudentity,L=Seattle,ST=Washinghton,C=US`. +5. Connect to `https://acp-admin.` with admin / admin and change the password immediately. diff --git a/content/en/docs/deployment/installation/Cloudentity/consent-apps.md b/content/en/docs/deployment/installation/Cloudentity/consent-apps.md index f35b75af..09de3f2d 100644 --- a/content/en/docs/deployment/installation/Cloudentity/consent-apps.md +++ b/content/en/docs/deployment/installation/Cloudentity/consent-apps.md @@ -5,14 +5,16 @@ weight: 2 --- Install Cloudentity sample consent applications for the Amplify Open Banking solution. -## Customize the Consent Helm chart +## Create a customized values.yaml file -Modify the `open-banking-fdx-consent-apps/values.yaml` file for FDX deployment and `open-banking-consent/values.yaml` file for Open Finance Brazil deployment: +Create a customized `values` file, for example, `myvalues.yaml`, and make your customizations. This file should contain only the sections of the `values.yaml` file that you wish to override. Any values not present in the customized file will be picked up from the original `values.yaml` file. | Value | Description | Default value | |:------------- |:------------------------------------- |:-------------- | -| dockerRegistry.username | Cloudentity repo username. | None | -| dockerRegistry.token | Cloudentity repo token. | None | +| dockerRegistry.username | Axway repo username. | None | +| dockerRegistry.token | Axway repo token. | None | +| dockerRegistryCloudentity.username | Cloudentity repo username. | None | +| dockerRegistryCloudentity.token | Cloudentity repo token. | None | | cert.internal.certManager | Define if cert-manager is used internally.
    False is currently not supported. | true | | cert.internal.certManagerNamespace | Namespace where cert-manager is installed. Use the result of the previous command. | None | | cert.ingress.certManager | Define if cert-manager is used externally.
    If set to false, define cert and keys with values below. | true | @@ -25,80 +27,51 @@ Modify the `open-banking-fdx-consent-apps/values.yaml` file for FDX deployment a | cert.ingress.consentPage.key | Use a dedicated key. Must be defined only if certManager and wildcard are set to false. | None | | cert.ingress.consentSS.cert | Use a dedicated certificate. Must be defined only if certManager and wildcard are set to false. | None | | cert.ingress.consentSS.key | Use a dedicated key. Must be defined only if certManager and wildcard are set to false. | None | - -Update the `open-banking-consent/files/consent.values.yaml` file: - -| Value | Description | Default value | -|:------------- |:------------------------------------- |:-------------- | -| acpURL | Cloudentity server URL. | None | -| consentPage.ingress.annotations.nginx.ingress.kubernetes.io
    /proxy-ssl-secret | \/consent-openbanking-consent-page-tls. | open-banking-consent
    /consent-openbanking-consent-page-tls | -| consentPage.ingress.hosts | Update with the consent page URL. | consent.\ | -| consentPage.ingress.tls.hosts | Update with the consent page URL. | consent.\ | -| consentAdmin.ingress.annotations.nginx.ingress.kubernetes.io
    /proxy-ssl-secret | \/consent-openbanking-consent-admin-tls. | open-banking-consent
    /consent-openbanking-consent-admin-tls | -| consentAdmin.ingress.hosts | Update with the consent admin URL. | consent-admin.\ | -| consentAdmin.ingress.tls.hosts | Update with the consent admin URL. | consent-admin.\ | -| consentSelfservice.ingress.annotations.nginx.ingress.kubernetes.io
    /proxy-ssl-secret | \/consent-openbanking-consent-self-service-tls. | open-banking-consent
    /consent-openbanking-consent-self-service-tls | -| consentSelfservice.ingress.hosts | Update with the consent Self service URL. | consent-selfservice.\ | -| consentSelfservice.ingress.tls.hosts | Update with the consent Self service URL. | consent-selfservice.\ | -| import.variables.consent_self_service_portal_url | Update with the consent self service portal url. | `https://consent-selfservice.` | -| import.variables.consent_admin_portal_url | Update with the consent admin portal url. | `https://consent-admin.` | -| import.variables.consent_page_url | Update with the consent page url. | `https://consent.` | -| import.variables.developer_tpp_url | Update with the developer tpp url.| `https://financroo.` | -| import.variables.postman_client_id | Update with the Postman client id. | postman-eks | -| import.variables.bank_io_client_id | Update with the Bank.io client id. | bankio-eks | -| import.variables.bank_io_redirect_uri | Update with the bank.io redirect url. | `https://services-api./login` | -| Import.Variables. dcr_jwks_uri | Openbanking central directory jwks info. | OBB Sandbox | -| Import.Variables.organization_id | Bank Organization ID registered at Central Directory. | None | -| Import.Variables.first_tpp_redirect_uri | Sample TPP1 used. | None | -| Import.Variables.second_tpp_redirect_uri | Sample TPP1 used. | None | +| openbanking.acpURL | Cloudentity server URL. | None | +| openbanking.consentPage.ingress.annotations.nginx.ingress.kubernetes.io
    /proxy-ssl-secret | \/consent-openbanking-consent-page-tls. | open-banking-consent-apps
    /consent-openbanking-consent-page-tls | +| openbanking.consentPage.ingress.hosts | Update with the consent page URL. | consent.\ | +| openbanking.consentPage.ingress.tls.hosts | Update with the consent page URL. | consent.\ | +| openbanking.consentAdmin.ingress.annotations.nginx.ingress.kubernetes.io
    /proxy-ssl-secret | \/consent-openbanking-consent-admin-tls. | open-banking-consent-apps
    /consent-openbanking-consent-admin-tls | +| openbanking.consentAdmin.ingress.hosts | Update with the consent admin URL. | consent-admin.\ | +| openbanking.consentAdmin.ingress.tls.hosts | Update with the consent admin URL. | consent-admin.\ | +| openbanking.consentSelfservice.ingress.annotations.nginx.ingress.kubernetes.io
    /proxy-ssl-secret | \/consent-openbanking-consent-self-service-tls. | open-banking-consent-apps
    /consent-openbanking-consent-self-service-tls | +| openbanking.consentSelfservice.ingress.hosts | Update with the consent Self service URL. | consent-selfservice.\ | +| openbanking.consentSelfservice.ingress.tls.hosts | Update with the consent Self service URL. | consent-selfservice.\ | +| openbanking.import.enabled | To import the default configuration for Open Finance Brazil or FDX deployment. Set to true for installation and then keep it false for upgrades. | false | +| openbanking.import.variables.consent_self_service_portal_url | Update with the consent self service portal url. | `https://consent-selfservice.` | +| openbanking.import.variables.consent_admin_portal_url | Update with the consent admin portal url. | `https://consent-admin.` | +| openbanking.import.variables.consent_page_url | Update with the consent page url. | `https://consent.` | +| openbanking.import.variables.developer_tpp_url | Update with the developer tpp url.| `https://financroo.` | +| openbanking.import.variables.postman_client_id | Update with the Postman client id. | postman-eks | +| openbanking.import.variables.bank_io_client_id | Update with the Bank.io client id. | bankio-eks | +| openbanking.import.variables.bank_io_redirect_uri | Update with the bank.io redirect url. | `https://services-api./login` | +| openbanking.import.variables. dcr_jwks_uri | Openbanking central directory jwks info. | OBB Sandbox | +| openbanking.import.variables.organization_id | Bank Organization ID registered at Central Directory. | None | +| openbanking.import.variables.first_tpp_redirect_uri | Sample TPP1 used. | None | +| openbanking.import.variables.second_tpp_redirect_uri | Sample TPP1 used. | None | ## Prepare deployment -1. Add the ACP Helm repository: +Create the target namespace on the cluster: - ```bash - helm repo add acp https://charts.acp.io - helm repo update - ``` +```bash +kubectl create namespace open-banking-consent-apps +``` -2. Create the target namespace on the cluster: +## Install the Consent Apps Helm chart - ```bash - kubectl create namespace open-banking-consent - ``` - -## Install the Consent Helm chart - -1. Deploy the Consent pre-requisites Helm chart from the Axway repository. +1. Deploy the Consent Apps Helm chart from the Axway repository. ```bash - helm install consent-prereq -n open-banking-consent open-banking-consent + helm install consent-apps -n open-banking-consent-apps open-banking-consent-apps -f myvalues.yaml ``` 2. Check that the status of the Helm command is deployed: ``` - NAME: consent-prereq - LAST DEPLOYED: - NAMESPACE: open-banking-consent - STATUS: deployed - REVISION: 1 - TEST SUITE: None - ``` - -3. Deploy the Open Banking Consent Helm chart from the CloudEntity repository. - {{% alert title="Note" color="primary" %}} Find the Open Banking Consent chart-version to use in the `open-banking-consent/README.md`. Otherwise use the latest.{{% /alert %}} - - ```bash - helm install consent -n open-banking-consent acp/openbanking –-version 0.1.9 -f open-banking-consent/files/consent.values.yaml - ``` - -4. Check that the status of the Helm command is deployed: - - ``` - NAME: consent + NAME: consent-apps LAST DEPLOYED: - NAMESPACE: open-banking-consent + NAMESPACE: open-banking-consent-apps STATUS: deployed REVISION: 1 TEST SUITE: None @@ -109,7 +82,7 @@ Update the `open-banking-consent/files/consent.values.yaml` file: 1. Wait a few minutes and use the following commands to check the deployment status. ``` - kubectl get pods -n open-banking-consent + kubectl get pods -n open-banking-consent-apps ``` 2. Verify that: @@ -128,13 +101,13 @@ Update the `open-banking-consent/files/consent.values.yaml` file: 3. Check ingress with this command: ```bash - kubectl get ingress -n open-banking-consent + kubectl get ingress -n open-banking-consent-apps ``` 4. Verify that these ingresses are provisioned. They must have a public ip or a dns value in the ADDRESS column. ``` - NAME HOSTS ADDRESS PORTS AGE + NAME HOSTS ADDRESS PORTS AGE consent-openbanking-consent-admin consent-admin. xxxxxxxxxxxxx.amazonaws.com 80, 443 2m consent-openbanking-consent-page consent. xxxxxxxxxxxxx.amazonaws.com 80, 443 2m consent-openbanking-consent-self-service consent-selfservice. xxxxxxxxxxxxx.amazonaws.com 80, 443 2m @@ -142,4 +115,4 @@ Update the `open-banking-consent/files/consent.values.yaml` file: ## Post Deployment -* Navigate to Openbanking workspace, Settings - Authorization - Trusted client certificates, and update the Trusted client certificates content with the `open-banking-consent/files/cert.pem` file attached. +* Navigate to Openbanking workspace, Settings - Authorization - Trusted client certificates, and update the Trusted client certificates content with the `open-banking-consent-apps/files/cert.pem` file attached. diff --git a/content/en/docs/deployment/installation/_index.md b/content/en/docs/deployment/installation/_index.md index ba26828c..badda2bc 100644 --- a/content/en/docs/deployment/installation/_index.md +++ b/content/en/docs/deployment/installation/_index.md @@ -8,7 +8,7 @@ This guide describes how to install the Amplify Open Banking solution. ## Connect to the Axway Repository -You must have a Service Account with Axway in order to access the Helm chart and public images. +You must have a [service account](https://docs.axway.com/bundle/platform-management/page/docs/management_guide/organizations/managing_organizations/managing_service_accounts/index.html) with Axway in order to access the Helm chart and public images. ### Access the Helm chart diff --git a/content/en/docs/deployment/installation/agents.md b/content/en/docs/deployment/installation/agents.md index e41b21a5..62cfe33e 100644 --- a/content/en/docs/deployment/installation/agents.md +++ b/content/en/docs/deployment/installation/agents.md @@ -3,17 +3,20 @@ title: "Amplify Agents Installation" linkTitle: "Amplify Agents" weight: 15 --- -Install Amplify Agents, discovery agent and traceability agent, for the Amplify Open Banking solution. For the detailed installation instructions please see [Connect API Manager](https://docs.axway.com/bundle/amplify-central/page/docs/connect_manage_environ/connect_api_manager/index.html) +Install Amplify Agents, discovery and traceability agents, for the Amplify Open Banking solution. For detailed installation instructions, see [Connect API Manager](https://docs.axway.com/bundle/amplify-central/page/docs/connect_manage_environ/connect_api_manager/index.html). -Also make sure that you configure discovery agent with IdP. For the detailed information see [Provisioning OAuth credential to an identity provider](https://docs.axway.com/bundle/amplify-central/page/docs/connect_manage_environ/connected_agent_common_reference/marketplace_provisioning/index.html#provisioning-oauth-credential-to-an-identity-provider). +Also make sure that you configure discovery agent with IdP. For the detailed information, see [Provisioning OAuth credential to an identity provider](https://docs.axway.com/bundle/amplify-central/page/docs/connect_manage_environ/marketplace_provisioning/index.html#provisioning-oauth-credential-to-an-identity-provider). -You can also use below sample discovery agent IdP configuration for Amplify Open Banking Deployment: +You can also use the following sample discovery agent IdP configuration for Amplify Open Banking Deployment: ```console AGENTFEATURES_IDP_NAME_1: "Cloudentity" AGENTFEATURES_IDP_TYPE_1: "generic" -AGENTFEATURES_IDP_METADATAURL_1: "" -AGENTFEATURES_IDP_AUTH_TYPE_1: "client" -AGENTFEATURES_IDP_AUTH_CLIENTID_1: "" -AGENTFEATURES_IDP_AUTH_CLIENTSECRET_1: "" -``` \ No newline at end of file +AGENTFEATURES_IDP_METADATAURL_1: "" +AGENTFEATURES_IDP_AUTH_TYPE_1: "tls_client_auth" +AGENTFEATURES_IDP_AUTH_CLIENTID_1: "string" +AGENTFEATURES_IDP_SSL_ROOTCACERTPATH_1: /tls/ca.crt +AGENTFEATURES_IDP_SSL_CLIENTCERTPATH_1: /tls/client.crt +AGENTFEATURES_IDP_SSL_CLIENTKEYPATH_1: /tls/client.key +AGENTFEATURES_IDP_AUTH_USECACHEDTOKEN_1: "false" +``` diff --git a/content/en/docs/deployment/installation/backend-services.md b/content/en/docs/deployment/installation/backend-services.md index c505be7d..6c9d2279 100644 --- a/content/en/docs/deployment/installation/backend-services.md +++ b/content/en/docs/deployment/installation/backend-services.md @@ -5,12 +5,12 @@ weight: 25 --- Install Backend Services for the Amplify Open Banking solution. -## Financial Data Exchange (FDX) +## Financial Data Exchange (FDX) deployments -Download the Amplify Open Banking Backend Services Helm chart to customize it locally. +Fetch the Amplify Open Banking Backend Services Helm chart to view the `values.yaml` file. ```bash -helm pull axway/open-banking-fdx-backend --untar +helm fetch axway/open-banking-fdx-backend --untar ``` You should get an `open-banking-fdx-backend` local folder. @@ -23,13 +23,12 @@ Customize the `values.yaml` file as follows. |:------------- |:------------------------------------- |:-------------- | | global.dockerRegistry.username | Login name to pull Docker images from the Axway Repository. | None | | global.dockerRegistry.token | Password token to pull Docker images from the Axway Repository. | None | -| global.apihost | MTLS apigateway endpoint. | None | -| global.apidomain | MTLS apigateway endpoint. | None | -| mysqldb.dbname | Mock backend database name. | *medicimockbackend* | -| mysqldb.dbuser | Mock backend database username. | *mockbank*_ | +| global.apihost | MTLS apigateway endpoint. | `https://mtls-api-proxy./open-banking` | +| mysqldb.dbname | Mock backend database name. | *fdxmockbackend* | +| mysqldb.dbuser | Mock backend database username. | *mockbank* | | secrets.MYSQL_ROOT_PASSWORD | Mock backend database root password. | None| | secrets.MYSQL_USER_PASSWORD | Mock backend database user password. | None | -| *apiname*.enable | To disable the API deployment set it to false | true | +| *apiname*.enable | To enable or disable the API deployment. | true | ### Install the Backend Services Helm chart @@ -42,13 +41,13 @@ Customize the `values.yaml` file as follows. 2. Install the Backend Services Helm chart: ```bash - helm install backend-services open-banking-fdx-backend -n open-banking-backend + helm install backend open-banking-fdx-backend -n open-banking-backend ``` 3. Check that the status of the Helm command is deployed: - ``` - NAME: backend-services + ```bash + NAME: backend LAST DEPLOYED: NAMESPACE: open-banking-backend STATUS: deployed @@ -74,16 +73,15 @@ Customize the `values.yaml` file as follows. fdxmoneymovement-xxx-xx 1/1 Running 0 2m fdxtax-xxx-xx 1/1 Running 0 2m obieproducts-xxx-xx 1/1 Running 0 2m - test-xxx-xx 1/1 Running 0 2m mysqldb-xxx-xx 1/1 Running 0 2m ``` -## Open Finance Brazil +## Open Finance Brazil deployments -Download the Amplify Open Banking Backend Services Helm chart to customize it locally. +Fetch the Amplify Open Banking Backend Services Helm chart to view the `values.yaml` file. ```bash -helm pull axway/open-banking-backend-chart --untar +helm fetch axway/open-banking-backend-chart --untar ``` You should get an `open-banking-backend-chart` local folder. diff --git a/content/en/docs/deployment/prerequisites.md b/content/en/docs/deployment/prerequisites.md index 806248b9..ef0a1697 100644 --- a/content/en/docs/deployment/prerequisites.md +++ b/content/en/docs/deployment/prerequisites.md @@ -4,7 +4,7 @@ linkTitle: "Prerequisites" weight: 1 --- -Amplify Open Banking is developed on Kubernetes with a "button-click" style deployment that allows customers to use the Kubernetes solution of their choice. +Amplify Open Banking deployment design is built on Kubernetes, which can be deployed either on premises or in the cloud. Preparing a Kubernetes cluster with the appropriate services and settings is required prior to the solution installation. @@ -22,29 +22,20 @@ Prior to installation you need to perform the following tasks: * Helm * Kubectl * Create a [service account](https://docs.axway.com/bundle/platform-management/page/docs/management_guide/organizations/managing_organizations/managing_service_accounts/index.html) in your organization in Amplify Platform to pull Helm charts and Docker images from the [Axway Repository](https://repository.axway.com/). -* Deploy the external MySQL and Cassandra databases infrastructure. +* Deploy the external Cassandra database infrastructure. * Create a Kubernetes cluster that conforms to the architecture described in the Architecture Overview guide and reflects the architecture choices described above. These tasks must be completed for a successful installation. ## Database requirements -The solutions use the following database components: +The solutions use the following external database components: -* Cassandra for API Manager catalog. - -The minimum recommended hardware infrastructure for these components are: - -* Cassandra Database: 1 cluster with 3 nodes, each with the following configuration: - * 2 CPUs. - * 8 GB of memory. - * 60 GB of disk. - - For more information, refer to [cassandra installation](https://docs.axway.com/bundle/axway-open-docs/page/docs/apim_installation/apigtw_install/cassandra_install/index.html). +* Cassandra for API Manager catalog. For Cassandra cluster requirements and installation, refer to [Cassandra installation](https://docs.axway.com/bundle/axway-open-docs/page/docs/apim_installation/apigtw_install/install_cassandra/index.html). ## Kubernetes setup requirements -A Kubernetes 1.16+ cluster is required to deploy the Amplify Open Banking Solution. +A Kubernetes 1.23+ cluster is required to deploy the Amplify Open Banking Solution. ### Resources @@ -67,6 +58,7 @@ The Kubernetes configuration must include three Node Groups: | Identity | Cloudentity | 1-3 | | Identity | CockroachDB | 1-3 | | Identity | Redis | 1-3 | +| Identity | TimescaleDB | 1-3 | {{% alert title="Note" color="primary" %}} The consent and backend components are not considered here, because they usually are replaced by customer's custom components.{{% /alert %}} @@ -99,7 +91,7 @@ A complete architecture requires a minimum of 3 subnets: * A subnet mask /24 is therefore recommended to support scaling, upgrade, and others tools for production. * *Database*: For databases provided inside the Kubernetes cluster a subnet mask of /29 is recommended. -Each subnet must be protected by a firewall implemented at Layer 4 of the OSI model with open routes kept to a bare minium. +Each subnet must be protected by a firewall implemented at Layer 4 of the OSI model with open routes kept to a bare minimum. ### Kubernetes components @@ -136,4 +128,4 @@ In case `external-dns` is not available in the cluster, you must manually config Axway uses the Externally Managed Topology (EMT) approach for scaling so instances can be managed by Kubernetes. Read [our guide](https://docs.axway.com/bundle/axway-open-docs/page/docs/apim_installation/apigw_containers/container_getstarted/index.html) on using EMT for further details. ---> \ No newline at end of file +--> diff --git a/content/en/docs/deployment/upgrade.md b/content/en/docs/deployment/upgrade.md index 777b2801..64a1c31e 100644 --- a/content/en/docs/deployment/upgrade.md +++ b/content/en/docs/deployment/upgrade.md @@ -10,17 +10,25 @@ The use of Helm charts and Docker images greatly improves and simplifies the Amp While the actual process of upgrade is straightforward, there are some prerequisite steps that you must perform to prepare for the upgrade. Primarily, it is critical that you backup your previous versions. --> -## Steps +## Upgrade Steps Backup your previous deployments if reusing the same directory: ```bash mkdir previous-version -mv open-banking-apim previous-version/ -mv open-banking-apim-config previous-version/ -mv open-banking-backend previous-version/ -mv open-banking-acp previous-version/ -mv open-banking-consent previous-version/ + +mv open-banking-apim previous-version/ +mv open-banking-cloudentity previous-version/ +mv open-banking-consent-apps previous-version/ + +# for FDX +mv open-banking-fdx-apim-config previous-version/ +mv open-banking-fdx-backend previous-version/ + +# for Open Finance Brazil +mv open-banking-apim-config previous-version/ +mv open-banking-backend-chart previous-version/ +mv open-banking-jwe-generator previous-version/ ``` Update your repo: @@ -33,25 +41,39 @@ Pull only the Helm charts you want to upgrade: ```bash helm search repo axway -helm pull axway/open-banking-apim --untar + +helm pull axway/open-banking-apim --untar +helm pull axway/open-banking-cloudentity --untar +helm pull axway/open-banking-consent-apps --untar + +# FDX components only +helm pull axway/open-banking-fdx-apim-config --untar +helm pull axway/open-banking-fdx-backend --untar + +# Open Finance Brazil components only helm pull axway/open-banking-apim-config --untar -helm pull axway/open-banking-backend --untar -helm pull axway/open-banking-acp --untar -helm pull axway/open-banking-consent --untar +helm pull axway/open-banking-backend-chart --untar +helm pull axway/open-banking-jwe-generator --untar ``` For each new Helm chart, update `open-banking-xxxxx/values.yaml` using the: * Install documentation of the components. * Previous values used in `previous-version/open-banking-xxxxx/value.yaml`. -* Release notes in `open-banking-xxxxx/README.md`. +* Release Notes. Execute the upgrade commands as required: ```bash helm upgrade apim -n open-banking-apim open-banking-apim +helm upgrade acp -n open-banking-cloudentity open-banking-cloudentity +helm upgrade consent-apps -n open-banking-consent-apps open-banking-consent-apps + +# FDX components only +helm upgrade apim-config -n open-banking-apim open-banking-apim-config +helm upgrade backend-services -n open-banking-backend open-banking-fdx-backend + +# Open Finance components only helm upgrade apim-config -n open-banking-apim open-banking-apim-config helm upgrade backend-services -n open-banking-backend open-banking-backend-chart -helm upgrade acp -n open-banking-acp open-banking-acp -helm upgrade consent -n open-banking-consent open-banking-consent ``` diff --git a/static/Images/Component_View_v320.svg b/static/Images/Component_View_v320.svg new file mode 100644 index 00000000..7a439260 --- /dev/null +++ b/static/Images/Component_View_v320.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/static/Images/FDX_Workflow.png b/static/Images/FDX_Workflow.png index 5960531c..6f3d7a16 100644 Binary files a/static/Images/FDX_Workflow.png and b/static/Images/FDX_Workflow.png differ diff --git a/static/Images/FDX_Workflow_0.png b/static/Images/FDX_Workflow_0.png new file mode 100644 index 00000000..afe13fb1 Binary files /dev/null and b/static/Images/FDX_Workflow_0.png differ diff --git a/static/Images/Infrastructure_View_0.png b/static/Images/Infrastructure_View_0.png index 5d8376bb..98b37ae1 100644 Binary files a/static/Images/Infrastructure_View_0.png and b/static/Images/Infrastructure_View_0.png differ diff --git a/static/Images/Solution_Overview_0.svg b/static/Images/Solution_Overview_0.svg index 58bd38ca..f4e2c881 100644 --- a/static/Images/Solution_Overview_0.svg +++ b/static/Images/Solution_Overview_0.svg @@ -1,2 +1,2 @@ \ No newline at end of file + \ No newline at end of file diff --git a/static/samples/apimanagement/openbanking_sample_values.yaml b/static/samples/apimanagement/openbanking_sample_values.yaml new file mode 100644 index 00000000..171bf1a4 --- /dev/null +++ b/static/samples/apimanagement/openbanking_sample_values.yaml @@ -0,0 +1,412 @@ +#This values file is designed to override default apigateway charts/apigateway/values.yaml file +#and add settings specific for Open Banking deployments. + +openbanking: + enabled: true + #For Open Banking Brazil deployment use value "OBB", for NA/FDX deployment use value "FDX". + standard: "FDX" + +nameOverride: "gateway" + +global: + domainName: "dev.open-banking.axway.com" + defaultRegistry: "docker.repository.axway.com/apigateway-docker-prod/7.7" + imagePullSecrets: + - name: regcred + imagePullPolicy: Always + initContainers: + securityContext: + runAsNonRoot: false + + cassandra: + enabled: true + hosts: + - variable: CASS_HOST + hostname: cassandra.cassandra.svc.cluster.local + username: "cassandra" + password: "cassandra" + keyspace: apim_dev + tkeyspace: t_apim_dev + + storage: + provisioningType: "dynamic" + storageClassName: "efs-sc" + classes: + - name: "efs-sc" + provisioner: "efs.csi.aws.com" + allowVolumeExpansion: true + parameters: + provisioningMode: "efs-ap" + fileSystemId: "fs-054e86ed38c52f5d2" + directoryPerms: "755" + volumes: + - name: events + enabled: true + accessModes: + - ReadWriteMany + capacity: 1Gi + persistentVolume: + csiDriver: "efs.csi.aws.com" + volumeHandle: "fs-054e86ed38c52f5d2::fsap-03d17b5be1d52d114" + reclaimPolicy: Delete + - name: gw-external-config + enabled: true + accessModes: + - ReadWriteMany + capacity: 1Mi + persistentVolume: + csiDriver: "efs.csi.aws.com" + volumeHandle: "fs-054e86ed38c52f5d2::fsap-03d17b5be1d52d114" + reclaimPolicy: Delete + - name: anm-external-config + enabled: true + accessModes: + - ReadWriteMany + persistentVolume: + csiDriver: "efs.csi.aws.com" + volumeHandle: "fs-054e86ed38c52f5d2::fsap-03d17b5be1d52d114" + reclaimPolicy: Delete + capacity: 1Mi + +apigateway: + anm: + license: + license.lic: | + FIPS=1 + SalesForce Connector=1 + ServiceNow Connector=1 + analytics=1 + api_visual_mapper=1 + apiportal=1 + company=Axway + deployment_type=docker + expires=Thu, 17 Aug 2023 15:48:01 GMT + mcafee=1 + name=Axway + sdkgenerator=1 + unrestricted=1 + version=7.7 + # SIGNATURE: 2865cb92427fe2141ee103bc5a8c2e2f2c4f204a6be7724cea3b3037c0da8259 + # SIGNATURE: a6597e7c8d4b4b9479171551493c4c4587c5cc179b1e866d953f5d625b88a55c + # SIGNATURE: 2955c6f1087f7e6ad0ac3229439bb729dfadabc7f4a98d7b01c23ce9490fc03a + # SIGNATURE: a21caa64aba6f2b9724f7115d13f2ae5a4ce3118d1dd2dd6415f06467a53ae02 + # SIGNATURE: 650331bdaeee7eb91e69c4849e6231bdab341beb22e70dc8f5d8c56a30660475 + # SIGNATURE: c8f4c50cd6c9795b845e1ba6578d33e973e1f5e5dcc0c0eba46d415b3d2f6a93 + # SIGNATURE: bb2180a5c17bdf9b59c725cbdd42b327506cb0b1921a3c07cb075580e66912ea + + replicaCount: 1 + image: + repository: "admin-nodemanager" + tag: "7.7.0.20230530-2-BN0034-ubi7" + generalConditions: + accept: "yes" + securityContext: + runAsNonRoot: false + resources: + limits: + memory: "2048Mi" + cpu: "1000m" + requests: + memory: "1Gi" + cpu: "250m" + ingress: + enabled: true + className: nginx + annotations: + cert-manager.io/cluster-issuer: "letsencrypt-prod" + nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" + nginx.ingress.kubernetes.io/ssl-passthrough: "true" + nginx.ingress.kubernetes.io/ssl-redirect: "true" + hosts: + - host: api-gateway-manager.dev.open-banking.axway.com + paths: + - path: / + pathType: ImplementationSpecific + tls: + - secretName: api-gateway-manager-tls + hosts: + - api-gateway-manager.dev.open-banking.axway.com + # OpenShift configuration + route: + enabled: false + + apimgr: + license: + license.lic: | + FIPS=1 + SalesForce Connector=1 + ServiceNow Connector=1 + analytics=1 + api_visual_mapper=1 + apiportal=1 + company=Axway + deployment_type=docker + expires=Thu, 17 Aug 2023 15:48:01 GMT + mcafee=1 + name=Axway + sdkgenerator=1 + unrestricted=1 + version=7.7 + # SIGNATURE: 2865cb92427fe2141ee103bc5a8c2e2f2c4f204a6be7724cea3b3037c0da8259 + # SIGNATURE: a6597e7c8d4b4b9479171551493c4c4587c5cc179b1e866d953f5d625b88a55c + # SIGNATURE: 2955c6f1087f7e6ad0ac3229439bb729dfadabc7f4a98d7b01c23ce9490fc03a + # SIGNATURE: a21caa64aba6f2b9724f7115d13f2ae5a4ce3118d1dd2dd6415f06467a53ae02 + # SIGNATURE: 650331bdaeee7eb91e69c4849e6231bdab341beb22e70dc8f5d8c56a30660475 + # SIGNATURE: c8f4c50cd6c9795b845e1ba6578d33e973e1f5e5dcc0c0eba46d415b3d2f6a93 + # SIGNATURE: bb2180a5c17bdf9b59c725cbdd42b327506cb0b1921a3c07cb075580e66912ea + + replicaCount: 1 + image: + repository: "gateway" + tag: "7.7.0.20230530-2-BN0034-ubi7" + generalConditions: + accept: "yes" + groupId: "ob-fdx-dev" + securityContext: + runAsNonRoot: false + resources: + limits: + memory: "2Gi" + cpu: 2 + requests: + memory: "0.5Gi" + cpu: 0.5 + extraVolumeMounts: + - name: gw-external-config + mountPath: /merge + - name: events + mountPath: /opt/Axway/apigateway/events + extraVolumes: + - persistentVolumeClaim: + claimName: gw-external-config + name: gw-external-config + - persistentVolumeClaim: + claimName: events + name: events + extraEnvVars: + - name: CASS_KEYSPACE_REPLICATION + value: "1" + - name: CASS_TKEYSPACE_REPLICATION + value: "1" + ingress: + enabled: true + className: nginx + annotations: + cert-manager.io/cluster-issuer: "letsencrypt-prod" + nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" + nginx.ingress.kubernetes.io/ssl-passthrough: "true" + nginx.ingress.kubernetes.io/ssl-redirect: "true" + hosts: + - host: api-manager.dev.open-banking.axway.com + paths: + - path: / + pathType: ImplementationSpecific + tls: + - secretName: api-manager-tls + hosts: + - api-manager.dev.open-banking.axway.com + + # OpenShift configuration + route: + enabled: false + + apitraffic: + license: + license.lic: | + FIPS=1 + SalesForce Connector=1 + ServiceNow Connector=1 + analytics=1 + api_visual_mapper=1 + apiportal=1 + company=Axway + deployment_type=docker + expires=Thu, 17 Aug 2023 15:48:01 GMT + mcafee=1 + name=Axway + sdkgenerator=1 + unrestricted=1 + version=7.7 + # SIGNATURE: 2865cb92427fe2141ee103bc5a8c2e2f2c4f204a6be7724cea3b3037c0da8259 + # SIGNATURE: a6597e7c8d4b4b9479171551493c4c4587c5cc179b1e866d953f5d625b88a55c + # SIGNATURE: 2955c6f1087f7e6ad0ac3229439bb729dfadabc7f4a98d7b01c23ce9490fc03a + # SIGNATURE: a21caa64aba6f2b9724f7115d13f2ae5a4ce3118d1dd2dd6415f06467a53ae02 + # SIGNATURE: 650331bdaeee7eb91e69c4849e6231bdab341beb22e70dc8f5d8c56a30660475 + # SIGNATURE: c8f4c50cd6c9795b845e1ba6578d33e973e1f5e5dcc0c0eba46d415b3d2f6a93 + # SIGNATURE: bb2180a5c17bdf9b59c725cbdd42b327506cb0b1921a3c07cb075580e66912ea + + serviceName: apim-apigateway-apitraffic + name: apitraffic + image: + repository: "gateway" + tag: "7.7.0.20230530-2-BN0034-ubi7" + generalConditions: + accept: "yes" + groupId: "ob-fdx-dev" + securityContext: + runAsNonRoot: false + resources: + limits: + memory: "2Gi" + cpu: 2 + requests: + memory: "0.5Gi" + cpu: 0.5 + extraVolumeMounts: + - name: gw-external-config + mountPath: /merge + - name: events + mountPath: /opt/Axway/apigateway/events + extraVolumes: + - persistentVolumeClaim: + claimName: gw-external-config + name: gw-external-config + - persistentVolumeClaim: + claimName: events + name: events + extraEnvVars: + - name: CASS_KEYSPACE_REPLICATION + value: "1" + - name: CASS_TKEYSPACE_REPLICATION + value: "1" + ingressMtls: mtls-api-proxy + ingressHttps: services-api + portHttps: 8443 + portMtls: 8065 + ingress: + enabled: true + className: nginx + name: "apim-apigateway-apitraffic" + certManager: true + issuedByLetsEncrypt: true + clusterIssuer: "letsencrypt-prod" + acmeChallengeType: http01 + #if certManager is true, cert and key will be ignored. Keep always an empty line after certificate. + wildcard: false + #Complete this line for a wildcard usage. + cert: | + -----BEGIN CERTIFICATE----- + <> + -----END CERTIFICATE----- + key: | + -----BEGIN RSA PRIVATE KEY----- + <> + -----END RSA PRIVATE KEY----- + annotations: + cert-manager.io/cluster-issuer: "letsencrypt-prod" + nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" + nginx.ingress.kubernetes.io/ssl-passthrough: "true" + nginx.ingress.kubernetes.io/ssl-redirect: "true" + hosts: + - host: api.dev.open-banking.axway.com + paths: + - path: / + pathType: ImplementationSpecific + tls: + - secretName: api-gateway-apitraffic-tls + hosts: + - api.dev.open-banking.axway.com + oauth: + enabled: false + route: + enabled: false + + # OpenShift configuration + route: + enabled: false + + aga: + enabled: false + route: + enabled: false + + apiportal: + enabled: false + route: + enabled: false + +## Configuration for v7-discovery subchart + discovery-agent: + # Deploy the discovery agent + enabled: true + image: + tag: "1.1.51" + env: + #LOG_LEVEL: debug, info, warn, error + LOG_LEVEL: info + CENTRAL_URL: "https://apicentral.axway.com" + CENTRAL_AUTH_URL: "https://login.axway.com/auth" + #DOSA-ID: https://docs.axway.com/bundle/axway-open-docs/page/docs/central/cli_central/cli_install/index.html#authorize-your-cli-to-use-the-amplify-central-apis + CENTRAL_AUTH_CLIENTID: "sample" + CENTRAL_ORGANIZATIONID: "sample" + CENTRAL_ENVIRONMENT: "sample" + CENTRAL_TEAM: "Default Team" + APIMANAGER_HOST: "apim-apigateway-apimgr" + APIMANAGER_PORT: "8075" + APIGATEWAY_HOST: "apim-apigateway-anm" + APIGATEWAY_PORT: "8090" + + APIMANAGER_SSL_INSECURESKIPVERIFY: "true" + CENTRAL_AGENTNAME: "" + CENTRAL_GRPC_ENABLED: "true" + AGENTFEATURES_MARKETPLACEPROVISIONING: "true" + AGENTFEATURES_PERSISTCACHE: "false" + AGENTFEATURES_IDP_NAME_1: "Cloudentity" + AGENTFEATURES_IDP_TYPE_1: "generic" + AGENTFEATURES_IDP_METADATAURL_1: "https://acp.dev.open-banking.axway.com/default/fdx-demo/.well-known/openid-configuration" + AGENTFEATURES_IDP_AUTH_TYPE_1: "client" + AGENTFEATURES_IDP_AUTH_CLIENTID_1: "sample" + AGENTFEATURES_IDP_AUTH_CLIENTSECRET_1: "sample" + + ## Configuration for v7-traceability subchart + traceability-agent: + ## Deploy the traceability agent + enabled: true + image: + tag: "1.1.52" + env: + LOG_LEVEL: info + CENTRAL_AGENTNAME: "sample" + CENTRAL_URL: "https://apicentral.axway.com" + CENTRAL_AUTH_URL: "https://login.axway.com/auth" + CENTRAL_DEPLOYMENT: "prod" + CENTRAL_AUTH_CLIENTID: "sample" + CENTRAL_ORGANIZATIONID: "sample" + CENTRAL_ENVIRONMENT: "sample" + CENTRAL_TEAM: "Default Team" + # EVENT_LOG_PATHS: "/opt/Axway/apigateway/events/axwaydemo_traffic-*.log" + EVENT_LOG_PATHS: "/opt/Axway/apigateway/events/*_traffic-*.log" + EVENT_LOG_INPUT: "true" + OPENTRAFFIC_LOG_INPUT: "false" + OPENTRAFFIC_LOG_PATHS: "/opt/Axway/apigateway/logs/opentraffic/*.log" + #DOSA-ID: https://docs.axway.com/bundle/axway-open-docs/page/docs/central/cli_central/cli_install/index.html#authorize-your-cli-to-use-the-amplify-central-apis + TRACEABILITY_HOST: "ingestion.datasearch.axway.com:5044" + TRACEABILITY_PROTOCOL: "tcp" + TRACEABILITY_SAMPLING_PERCENTAGE: 100 + TRACEABILITY_SAMPLING_REPORTALLERRORS: "true" + + APIMANAGER_HOST: "apim-apigateway-apimgr" + APIMANAGER_PORT: "8075" + # flip to true if API manager is using a self signed certificate + APIMANAGER_SSL_INSECURESKIPVERIFY: "true" + APIGATEWAY_ONLY: "false" + APIGATEWAY_HOST: "apim-apigateway-anm" + APIGATEWAY_PORT: "8090" + # flip to true if API gateway is using a self signed certificate + APIGATEWAY_SSL_INSECURESKIPVERIFY: "true" + APIGATEWAY_HEALTHCHECKPORT: 8090 + APIGATEWAY_HEALTHCHECKPROTOCOL: "https" + APIGATEWAY_HEALTHCHECKURI: login + + CENTRAL_GRPC_ENABLED: "true" + AGENTFEATURES_MARKETPLACEPROVISIONING: "true" + AGENTFEATURES_PERSISTCACHE: "true" + TRACEABILITY_PER_SUBSCRIPTION: "true" + persistentVolumeClaimConfig: + data: + # storage class to persist contents of data directory in the agent - should be available in the cluster i.e gp2, gp2-csi, default + storageClass: efs-sc + name: data-claim + events: + name: events + mountPath: "/opt/Axway/apigateway/events" \ No newline at end of file