Open Exposure Gateway¶

The Open Exposure Gateway (OEG) is the northbound entry point of OpenOP. It serves the CAMARA APIs to application providers, checks each caller's Keycloak token, hands the work to the Service Resource Manager (SRM) and forwards the operator's federation calls to the Federation Manager (FM).

New in this release¶

OEG is rebuilt as a FastAPI service with its own PostgreSQL database. Long-running work (application instances, deployments, QoD sessions and Traffic Influence) goes to SRM as DataBus (NATS) commands. OEG tracks each operation and reports the outcome through the resource status and CAMARA CloudEvent callbacks. Reads and device location call SRM over HTTP.

• Edge applications. Register, read and remove applications (/apps), create, list and terminate instances (/appinstances), multi-zone deployments (/deployments) and the zone list (/edge-cloud-zones).
• Network APIs. QoD sessions; Traffic Influence, including creation for a single device (/traffic-influence-devices); device location (/retrieve).
• Federation for operators. Our identity and zones, the partner registry, one agreement per partner, and the federation lifecycle with each partner under /partners/{partnerOpId}/federations, including partner zone subscriptions. OEG forwards these calls to FM.
• Security. Every call needs a Keycloak access token. OEG checks the role and the CAMARA scope that each operation needs, and stores callback credentials encrypted.
• Conformance. make conformance runs every operation of the vendored CAMARA specs with schemathesis.

Breaking changes¶

• Every path changes. The single /oeg/1.0.0/... base is replaced by one base path per API (table above). Federation calls move to /platform/v1/federation/partners/{partnerOpId}/federations/..., where partnerOpId is the id FM gives a partner when it is registered.
• Every call needs a token. Federation routes need the operator role.
• Results belong to the caller. GET /apps, /appinstances and /deployments return only the calling App Provider's resources.
• Long-running calls are asynchronous. Instances, deployments, QoD and Traffic Influence answer with a pending status; the final state comes through the resource status and callbacks.
• Errors follow CAMARA ErrorInfo. Federation routes answer with GSMA ProblemDetails.
• Storage and configuration. OEG needs PostgreSQL and NATS instead of MongoDB. Settings are nested environment variables such as SRM_SETTINGS__BASE_URL, FM_SETTINGS__BASE_URL, POSTGRESQL_SETTINGS__URL, NATS_SETTINGS__URL and KEYCLOAK_SETTINGS__*. All of them are in src/open_exposure_gateway/core/config.py.

Upgrade notes¶

Install fresh with oop-platform 2.0.0; nothing is migrated from 1.0.0. Back up the oegcontroller-keys Secret (callback-secret-key) together with the database, because stored callback credentials cannot be read with another key.

Known limitations¶

The full list is in the spec's Implementation & Delivery › Known Gaps. The main ones:

• Not implemented (501): PATCH /deployments/{id}, GET /clusters, QoD POST /sessions/{id}/extend and POST /retrieve-sessions, and Traffic Influence PATCH /traffic-influences/{id}.
• Callbacks are sent once, with no retry. Poll the resource if a callback is missed.
• Commands to SRM are not durable. A command lost on the way is not resent; a periodic sweep marks stuck operations as failed.
• Results are scoped to the App Provider, not to their organization.
• Quotas, rate limits and charging are not enforced.
• Consent and the mapping from token to device are open. Location retrieval needs an explicit device in the request.
• Subscription options such as subscriptionMaxEvents and initial events are ignored.