DataPower

DataPower

Join this online group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Difficulties installing DataPower (alone) on OpenShift

    Posted Wed April 28, 2021 11:05 AM
    I have been struggling for the last days on the installation of DataPower on OpenShift (DP alone, not part of CP4I or APIC).
    I was able to create a DataPowerService, but not to use it.

    Here are the details of what I did:
    -  I was able to create an operator, a DataPowerService and a DataPowerMonitor. However, I could not go any further. I found kind of a documentation (https://ibm.github.io/datapower-operator-doc/), but it did not provide me with the level of information I needed.

    - It seems that the DataPowerService which was created includes the REST admin interface only:
       mgmtPorts:
        - name: rest-mgmt
          port: 5554
    And it does not seem possible to add other interfaces (such as the Web mgmt interface) when creating the DataPowerService.

    - A "datapower-operator" service was also created, but it does not include the 5554 port. I added it:
        - name: rest-mgmt
          protocol: TCP
          port: 5554
          targetPort: 5554

    - No route was created and I created one with settings suitable for the REST mgmt interface:
      host: datapower-os.datapower-os.apps.ace4pm.os.fyre.ibm.com
      to:
        kind: Service
        name: datapower-operator
        weight: 100
      port:
        targetPort: rest-mgmt
      tls:
        termination: passthrough
      wildcardPolicy: None

    With these settings, I am still not able to reach the REST mgmt interface:
    curl -u admin:******* -k -v https://datapower-os.datapower-os.apps.ace4pm.os.fyre.ibm.com/mgmt/status/default/DateTimeStatus
    *   Trying 9.30.189.245...
    * TCP_NODELAY set
    * Connected to datapower-os.datapower-os.apps.ace4pm.os.fyre.ibm.com (9.30.189.245) port 443 (#0)
    * ALPN, offering http/1.1
    * Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
    * TLSv1.2 (OUT), TLS header, Certificate Status (22):
    * TLSv1.2 (OUT), TLS handshake, Client hello (1):
    * OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to datapower-os.datapower-os.apps.ace4pm.os.fyre.ibm.com:443
    * Closing connection 0
    curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to datapower-os.datapower-os.apps.ace4pm.os.fyre.ibm.com:443

    Any idea?

    ------------------------------
    Patrick Marie
    ------------------------------


  • 2.  RE: Difficulties installing DataPower (alone) on OpenShift

    Posted Wed April 28, 2021 06:10 PM
    The problem is fixed now. I had to create a Configuration map, to refer to it in the DataPowerService, then to define and service and a route. Now the Web management interface is available.

    ------------------------------
    Patrick Marie
    ------------------------------

    Original Message


  • 3.  RE: Difficulties installing DataPower (alone) on OpenShift

    Posted Wed April 28, 2021 08:03 PM
    Hi Patrick,

    The DataPower Operator does not automatically configure the WebGUI (web-mgmt) service in the DataPower operand. The rest-mgmt service is configured by default because it is used for internal communication between the operator and the DataPower itself. If you wish you enable the web-mgmt service you would do so via ConfigMap utilizing the domains API. For example, the ConfigMap might look like:

    apiVersion: v1
kind: ConfigMap
metadata:
  name: web-mgmt
data:
  web-mgmt.cfg: |
    top; configure terminal;
    web-mgmt
      admin-state enabled
      local-address 0.0.0.0
      port 9090
      save-config-overwrite
      idle-timeout 9000
      ssl-config-type server
    exit​

    Then you can add this in a domains spec, like so:

    spec:
  domains:
  - name: default
    dpApp:
      config:
      - web-mgmt​

    There is an in-depth guide to the domains API here: https://ibm.github.io/datapower-operator-doc/guides/domain-configuration

    If you wish to expose any service (whether it be an MPGW or web-mgmt), you would do so by creating your own Service object and exposing it with either an Ingress or a Route. You should not modify the Service objects that the operator creates by default.

    https://ibm.github.io/datapower-operator-doc/guides/service-ingress-route

    I hope this helps.

    ------------------------------
    Aidan Harbison
    ------------------------------

    Original Message