1
0
Fork 0
mirror of https://github.com/arangodb/kube-arangodb.git synced 2024-12-14 11:57:37 +00:00
kube-arangodb/docs/design/api.md

36 lines
1.8 KiB
Markdown

---
layout: page
title: Operator API
parent: Design overview
---
# Operator API
A running operator exposes HTTP and gRPC API listeners to allow retrieving and setting some configuration values programmatically.
Both listeners require a secured connection to be established. It is possible to provide TLS certificate via k8s secret
using command line option `--api.tls-secret-name`. If secret name is not provided, operator will use self-signed certificate.
Some HTTP endpoints require the authorization to work with. All gRPC endpoints require the authorization.
The authorization can be accomplished by providing JWT token in 'Authorization' header, e.g. `Authorization: Bearer <token>`
The JWT token can be fetched from k8s secret (by default `arangodb-operator-api-jwt`). The token is generated automatically
on operator startup using the signing key specified in `arangodb-operator-api-jwt-key` secret. If it is empty or not exists,
the signing key will be auto-generated and saved into secret. You can specify other signing key using `--api.jwt-key-secret-name` CLI option.
## HTTP
The HTTP API is running at endpoint specified by operator command line options `--api.http-port` (8628 by default).
The HTTP API exposes endpoints used to get operator health and readiness status, operator version, and prometheus-compatible metrics.
For now only `/metrics` and `/log/level` endpoints require authorization.
## gRPC
The gRPC API is running at endpoint specified by operator command line options `--api.grpc-port` (8728 by default).
The gRPC API is exposed to allow programmatic access to some operator features and status.
gRPC protobuf definitions and go-client can be found at `github.com/kube-arangodb/pkg/api/server` package.
All gRPC requests require per-RPC metadata set to contain a valid Authorization header.