Federation Manager¶

The Federation Manager (FM) connects one OpenOP platform to the platforms of partner operators. It implements the GSMA OPG East/Westbound Interface (EWBI) in both roles: as the partner, it answers requests from other operators; as the originating platform, it sends our own requests out.

New in this release¶

FM is rewritten as a FastAPI service backed by PostgreSQL (with Alembic migrations) and NATS JetStream. It serves two surfaces on separate ports:

• As the partner: create, read and delete a federation and report its health; offer zones and accept zone subscriptions; onboard applications (including Helm charts), install and remove them through SRM; answer QoD sessions and device location queries through SRM; receive partner status callbacks.
• As the originating platform (driven by operators through OEG and the Portal): the partner registry, one agreement per partner, the federation lifecycle, partner zone subscriptions, and federated deploy and terminate handed over by SRM.
• Topology hiding on every EWBI response.
• Partner secrets are stored encrypted (FM_PARTNER_SECRET_KEY).
• Federation at startup with every active partner, optional (FM_BOOTSTRAP_FEDERATION).

Breaking changes¶

• OPG.04 v4.0 is replaced by OPG.04 v6.0 (EWBI API 1.4.0). The vendored GSMA spec and the OOP profile overlay are under docs/ in the repository.
• API documentation moves from /ui/ and /openapi.yaml to /docs and /openapi.json.
• Ports. The EWBI moves from 8990 to 8082. The internal API is served only on 8083.
• Separate internal API. The X-Internal and X-Partner-API-Root headers are gone; operator calls go to /internal/*, normally through OEG.
• PostgreSQL replaces MongoDB, and FM needs NATS JetStream.
• Configuration is FM_* environment variables instead of src/conf/config.cfg. They are listed in the README.
• Health is the GSMA GetFederationHealth operation instead of the heartbeat route.
• Partner tokens must be issued for this FM; tokens for another audience are refused.

Upgrade notes¶

• Install fresh with oop-platform 2.0.0; nothing is migrated from 1.0.0.
• Register partners again, in the Portal's Federation page or through OEG's /platform/v1/federation/partners.
• Back up the federation-manager-keys Secret (partner-secret-key) together with the database. A different key cannot read the stored partner secrets.
• Give every deployment its own FM_EVENT_CONSUMER_DURABLE name.

Known limitations¶

The full status is in the spec's Implementation & Delivery › Delivery Plan. The main ones:

• RenewFederation and UpdateFederation are not implemented.
• Partners authenticate with client credentials only. mTLS on the EWBI is deferred (ADR-0042).
• No per-partner rate limits, and no admin API for routing rules.
• Inbound deploys are not capacity-checked with SRM.
• Not built: inbound Device Status, federation usage records and the transaction query API.
• No metrics.