Management services API gateway
A technique provides cohesive and secure access to management services of a distributed storage architecture deployed on compute and storage nodes of a cluster. The management services are organized as a platform that encompasses a plurality of underlying individual services each having an applications programming interface (API) that are together securely accessible via an API gateway. The gateway is configured to support a “browsable” directory of the APIs that enables a client to identify various underlying services available within the cluster. In an embodiment, the underlying services “self-register” at the gateway to provide a single, unified location for the client to access the services. The API gateway includes a reverse-proxy server that is configured to provide a single point of entry for clients interacting with the individual services underlying the management services platform. User authorization and authentication security are implemented at the API gateway rather than on the underlying services.
1. A method comprising:
registering, at a gateway, an application programming interface (API) by each service of a plurality of services of a cluster;
configuring the gateway to provide a browsable directory of the APIs for a client to formulate an API call;
receiving the API call at the gateway from the client for a first service, the gateway acting as a reverse-proxy for the plurality of services;
authenticating, at the gateway, a user of the API call for obtaining an access token; and
forwarding the API call from the gateway to the first service, wherein the forwarded API call includes a first portion of the access token for verifying the API call at the first service wherein
the registering comprises:
receiving, at the gateway, a configuration file from a respective service of the plurality of services; and
generating code at the gateway from the configuration file to add the API to the browsable directory for a hypertext transfer protocol (HTTP) server, and
the authentication comprises:
redirecting an access request included in the API call from the client to an authentication server.
2. The method of claim 1 , wherein the access token is valid for a limited duration.
3. The method of claim 1 , wherein the HTTP server continues uninterrupted during the addition of the API to the browsable directory.
4. The method of claim 1 , wherein the API call includes a Java Script Object Notation (JSON) remote procedure call (RPC) and wherein parameters of the API call are encoded according to JSON.
5. The method of claim 1 , wherein the browsable directory is organized as a hierarchical namespace.
6. The method of claim 1 , wherein the plurality of services is accessed transparent to any authentication and access authorization mechanism.
7. The method of claim 1 , wherein the browsable directory provides a single unified API namespace.
8. A system comprising:
a gateway having a cluster interface for nodes of a cluster that provide a plurality of services;
a network interface included in the gateway coupled to a client;
a processor included in the gateway coupled to the cluster interface and the network interface, the processor configured to execute instructions to:
register an application programming interface (API) by each service of the plurality of services;
configure the gateway to provide a browsable directory of the APIs for the client to formulate an API call;
receive the API call at the network interface from the client for a first service, the gateway acting as a reverse-proxy for the plurality of services;
authenticate, at the gateway, a user of the API call to obtain an access token; and
forward the API call to the first service via the cluster interface, wherein the forwarded API call includes a first portion of the access token for verifying the API call at the first service wherein the registering comprises:
receiving, at the gateway, a configuration file from a respective service of the plurality of services; and
generating code at the gateway from the configurating file to add the API to the browsable directory for hypertext protocol (HTTP) server, and
the authentication comprises:
redirecting an access request included in the API call from the client to an authentication server.
9. The system of claim 8 , wherein the access token is valid for a limited duration.
10. The system of claim 8 , wherein the HTTP server continues uninterrupted during the addition of the API to the browsable directory.
11. The system of claim 8 , wherein the API call includes a Java Script Object Notation (JSON) remote procedure call (RPC), wherein parameters of the API call are encoded according to JSON.
12. The system of claim 8 , wherein browsable directory is organized as a hierarchical namespace.
13. The system of claim 8 , wherein the plurality of services is accessed transparent to any authentication and access authorization mechanism.
14. A non-transitory computer readable medium having instructions configured to:
register, at a gateway, an application programming interface (API) by each service of a plurality of services of a cluster;
configure the gateway to provide a browsable directory of the APIs for a client to formulate and API call;
receive the API call at the gateway from the client for a first service, the gateway acting as a reverse-proxy for the plurality of services;
authenticate, at the gateway, a user of the API call to obtain an access token; and
forward the API call from the gateway to the first service, wherein the forwarded API call includes a portion of the access token for verifying the API call at the first service and the authentication comprises:
redirecting an access request included in the API call from the client to an authentication server;
receiving, by the gateway, the first portion of the access token from the authentication server; and
providing a second portion of the access token by the authentication server to the first service.
15. The system of claim 8 , wherein the API is verifiable using the first and second portion of the access token at the first service.
16. The method of claim 1 , wherein the API call is verifiable using the first and second portion of the access token at the first service.
17. The method of claim 1 , further comprising:
registering the plurality of services at the gateway.
18. The method of claim 17 , further comprising:
the services dynamically configuring the gateway to provide incoming requests interaction with the services.
19. The method of claim 1 , wherein the authentication further comprises:
receiving, by the gateway, the first portion of the access token from the authentication server; and
providing a second portion of the access token by the authentication server to the first service.
20. The system of claim 8 , wherein the authentication further comprises:
receiving, by the gateway, the first portion of the access token from the authentication server; and
providing a second portion of the access token by the authentication server to the first service.