Open galenatjpl opened 1 year ago
We should have a tag-up on this. If we are supporting multiple deployments in each venue, I would expect this kind of routing for the SIPS TEST venue and an EKS cluster named "fwd-processing":
WPS-T API endpoint: https://unity-sds.jpl.nasa.gov/sips/test/fwd-processing/wpst --> http://a0442fd7f829f49059fd68d1236aa263-650360946.us-west-2.elb.amazonaws.com:5001/
SPS API endpoint: https://unity-sds.jpl.nasa.gov/sips/test/fwd-processing/sps --> http://a7096fc6842e84da688b45586d194498-2116025617.us-west-2.elb.amazonaws.com:5002/
and similar for ADES specific endpoints if we want to support them, like the HySDS figaro and tosca.
Evaluated the feasibility to pass traffic from Public API Gateway in Unity-Test account to a Private in the Unity-Sips-Test account. Usually this connectivity should be implemented as follows.
Public API -> VPC Link -> NLB -> Private API VPC Endpoint -> Private API
Related Posts/ Articles:
However, this can introduce additional complexity and additional hops to the connectivity. Also, some of the approaches proposed in above links need the use of Amazon Route 53.
An alternative approach is to use public API gateways in API Gateway in Unity-Test account and also another public API Gateway in the Unity-Sips-Test account.Currently evaluating this approach.
Related References:
Controlling and managing access to a REST API in API Gateway
AWS API Gateway authentication - 6 ways to control access
Evaluating access control methods to secure Amazon API Gateway APIs
Pushing this ticket to 23.3 release. We are partially blocked by MCP fully getting roles as code lambda integrated into their system. Also, the fully automatic API registration we decided isn't ready for 23.2.
This work is all basically done, except for the remaining work pertaining to the locking down at the network level of the access to gateways/subnets/components, etc.. Will create a separate ticket for that work.
As a necessary prerequisite to getting https://github.com/unity-sds/unity-project-management/issues/71 done, we want to make sure some basic routing support is in place on the Unity-Test and Unity-Sips-Test accounts.
For this deployment, there will be two API Gateways:
In the Unity-Sips-Test account, project deployments will occur (e.g. SPS deployments), and these SPS endpoints need to be automatically hooked up to the API Gateways.
The types of routes that need to be inserted are:
Acceptance Criteria: