Integrating to APIs via APEX

Prerequisite

You should already be an APEX Cloud Publisher or Consumer.

Ingress requirements

Whitelist APEX Cloud Outbound to Agency IPs:

• Configure APEX Production IPs whitelisting for apps hosted in Cstack Prod. Refer to APEX documentation for the list of IPs. Note: This page requires TechPass login.

• Configure APEX Staging IPs whitelisting for apps hosted in Cstack Prod. Refer to APEX documentation for the list of IPs. Note: This page requires TechPass login.

• Configure the Kong IP-Whitelist Plugin that allows APEX Outbound IPs. Refer to Kong IP-Restriction Plugin.

Sample Kong plugin manifest

apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: allow-apex-stg
config:
  allow:
    - {replace-with-apex-ip1}/32
    - {replace-with-apex-ip2}/32
    - {replace-with-apex-ip2}/32
plugin: ip-restrictionCopy to clipboardErrorCopied

Sample ingress with Kong annotation

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata: 
  name: <your_ingress_name>
  namespace: <your_namespace>
  annotations:
    konghq.com/plugins: allow-apex-stg
spec:
  ingressClassName: kong
  rules:
    - host: <your_app_name>.stg.gen-e01.app.gov.sg
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: <your_app_name>
                port:
                  number: 443  Copy to clipboardErrorCopied

Egress requirements

Whitelist APEX API Domain:

• Configure APEX Staging domain whitelisting: https://gw-stg.int.api.gov.sg/

• Configure APEX Production domain whitelisting in CStack Prod: https://gw.int.api.gov.sg/healthcheck

• Configure ServiceEntry that allows connectivity to Apex domain (example)

For more details, you can refer to Managing Whitelists.

Sample ServiceEntry manifest

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: apex-stg-domain
spec:
  exportTo:
  - .
  hosts:
  - gw-stg.int.api.gov.sg
  ports:
  - name: http
    number: 80
    protocol: HTTP
  - name: https
    number: 443
    protocol: HTTPS
  resolution: DNS
  location: MESH_EXTERNALCopy to clipboardErrorCopied

Troubleshooting

• My app that is hosted in CStack GEN cannot communicate with APEX API endpoints.
  • Try resolving the following endpoints to investigate
    • From CStack Dev/Stg: https://gw-stg.int.api.gov.sg/healthcheck
    • From CStack Prd: https://gw.int.api.gov.sg/healthcheck
• APEX Consumers cannot communicate with my app hosted in CStack GEN.
  • Check if your app endpoint (e.g. https://{my-app}.dev.gen-e01.app.gov.sg) is accessible from GSIB (via SG-VPN).
  • Check if you have configured the Kong IP Whitelisting plugin correctly.