Platform services¶

Shared infrastructure behind the platform's components: identity, the asynchronous DataBus, and storage. They ship with the umbrella Helm chart and are not part of the CAMARA or GSMA API surface.

Keycloak¶

Keycloak is the platform's OAuth 2.0 / OpenID Connect identity provider. Realm oop issues tokens for Portal users and App Providers that the Open Exposure Gateway validates (audience oeg, role plus CAMARA scope); realm federation issues client-credentials tokens that partner Operator Platforms present to the Federation Manager; and, when the Data Lab is turned on, realm dataspace signs in its users. The Portal logs people in with Authorization Code + PKCE via the oop-portal client. How to grant roles and API products is covered under Manage users and access.

NATS (DataBus)¶

NATS is the platform DataBus: the Open Exposure Gateway, Service Resource Manager and Federation Manager exchange async work and completion signals on subjects such as command.srm.* and event.srm.*. Release 2 enables JetStream so Federation Manager can keep durable streams (OOP_TASKS / OOP_EVENTS); OEG and SRM publish and subscribe with core NATS on the same broker. Long-running CAMARA operations answer at once with a pending status after OEG publishes a command; the resource's state catches up when SRM emits completion or status events.

PostgreSQL¶

PostgreSQL is the shared persistence layer. One instance is deployed for the platform, with a separate database and role per component (keycloak, portal, oeg, srm, fm) so no service reads another component's tables directly. OEG stores operations and northbound resources; SRM stores catalog, topology and inventory; Federation Manager stores federation state; Keycloak and the Portal keep their own data. Passwords are generated into the postgres-credentials Secret by the Helm chart.

Read more in Platform Architecture Specification › Technology Stack, DataBus Configuration and Security Architecture.