Cloud-native API Administration with Red Hat 3scale API Management

After completing this section, you should be able to customize request processing using APIcast policies.

Red Hat 3scale API Management includes APIcast, which configures an underlying NGINX web server to act as a proxy for your APIs. Many objects in 3scale API Management, such as products and backends, are abstractions for this configuration.

Policies enable higher flexibility and control in how APIcast handles traffic by providing more-granular abstractions for the NGINX proxy configuration.

Configured policies exist within a product as part of a policy chain, which is an ordered list of policies that every request to the product is filtered through.

Figure 3.4: Example of a policy chain processing a request.

In the preceding example diagram, blue boxes represent the policies, and dashed outlines show which policies are optional. Note that the default 3scale APIcast policy is required, as it represents 3scale API Management's routing configuration.

Each policy within a chain can alter or add information to the request before it is sent to the next policy.

Alternatively, a policy might conditionally alter how the request is handled. For example, an authorization policy might short-circuit a request and reject it before it reaches later polices or an API. In this way, policies can potentially improve the performance or resource usage of your system.

The standard policies provided by 3scale API Management address various needs, including the following:

Policies that customize how APIcast routes incoming requests include the following:

The collection of standard policies also includes policies to handle authentication and authorization tasks, such as the following:

Policies that provide miscellaneous utility functions include the following:

Currently, you can manage the policies of a product in two ways.

Using the toolbox CLI, you can export and import policy chains by using the 3scale policies super-command. For example, the following commands export an example policy chain as YAML and then re-imports it:

[student@workstation ~]$ 3scale policies export 3scale-tenant \
policy_sandbox >> policy_chain.yml
[student@workstation ~]$ cat policy_chain.yml
---
- name: routing
  version: builtin
  configuration: {}
  enabled: true
- name: apicast
  version: builtin
  configuration: {}
  enabled: true
- name: maintenance_mode
  version: builtin
  configuration: {}
  enabled: true
[student@workstation ~]$ 3scale policies import 3scale-tenant \
policy_sandbox -f policy_chain.yml

The name of the product is policy_sandbox and the -f option specifies the name of the file to import. See the references section for more information about exporting and importing product policy chains by using the toolbox CLI.

In most cases, you use the Admin Portal to manage policies. To add a policy via the Admin Portal, use the Integration → Policies section within the product. This graphical editor enables you to update the product's policy chain.

Figure 3.5: The Policies section within a product in the Admin Portal.

Once added, individual policies can be updated, removed, and reordered within the policy chain.

In the accompanying guided exercise, you practice adding, updating, reordering, and removing policies from a product by using the Admin Portal.