feat(fm): reach FM's internal API through a ClusterIP-only Service

| Portal | http://localhost:30082 |

| Data Lab (when enabled) | http://localhost:30083 |

Inside the cluster: `http://oeg`, `http://srm:8080`, `http://federation-manager:8082`,

Inside the cluster: `http://oeg`, `http://srm:8080`, `http://federation-manager:8082` (E/WBI),

`http://federation-manager-internal:8083` (FM internal API),

`http://keycloak:8080`, `nats://oop-nats:4222`, `postgres:5432`.

---

Deploys Federation Manager (FM) 2.0, the part of OOP that talks to other operators' platforms

(partner OPs) over the GSMA OPG.04 East/Westbound Interface (E/WBI). Partners call it under

`/operatorplatform/federation/v1`; OEG and SRM call its internal API under `/internal/...`.

`/operatorplatform/federation/v1` on port 8082; OEG and SRM call its internal API under

`/internal/...` on port 8083, which FM serves on no other port.

The chart creates:

- a Deployment `federation-manager` (one container on port 8082, running as uid 10001, plus an

- a Deployment `federation-manager` (one container on ports 8082 and 8083, running as uid 10001, plus an

  init container that waits for the database);

- a Service `federation-manager` (port 8082);

- a Service `federation-manager` (port 8082, the E/WBI partners call);

- a Service `federation-manager-internal` (port 8083, always `ClusterIP`) for the internal API;

- a Secret `federation-manager-keys` holding the generated partner secret key (see

  [Partner secret key](#partner-secret-key)).

The issuer and the key URL differ because partners see Keycloak on its public address while FM, in

a pod, may only reach `http://keycloak:8080`.

The internal API (`/internal/...`) has no login in this release. Keep the FM Service reachable only

from the cluster and from partners.

The internal API (`/internal/...`) has no login in this release. FM answers it only on port 8083,

behind the `ClusterIP` Service `federation-manager-internal`, so publishing the E/WBI Service as a

NodePort or through an ingress never publishes it; on 8082 `/internal/...` returns `404`.

## Callback links

| `federationManager.image.tag` | string | `2.0.0` | Image tag |

| `federationManager.image.pullPolicy` | string | `IfNotPresent` | Image pull policy |

| `federationManager.imagePullSecrets` | list | `[]` | Pull secrets for a private registry |

| `federationManager.service.name` | string | `federation-manager` | Service name, the in-cluster host name OEG and SRM use |

| `federationManager.service.name` | string | `federation-manager` | Name of the E/WBI Service |

| `federationManager.service.type` | string | `ClusterIP` | `ClusterIP` or `NodePort` (kind: `NodePort`) |

| `federationManager.service.port` | int | `8082` | Service port |

| `federationManager.service.targetPort` | int | `8082` | Container port |

| `federationManager.service.nodePort` | string/int | `""` | NodePort when `service.type=NodePort` (kind: `30989`) |

| `federationManager.internalService.name` | string | `federation-manager-internal` | Service for the internal API, the host name OEG and SRM use |

| `federationManager.internalService.port` | int | `8083` | Internal Service port |

| `federationManager.internalService.targetPort` | int | `8083` | Container port of the internal API (`FM_INTERNAL_PORT`) |

| `federationManager.resources` | object | `{}` | Container resource requests/limits |

| `federationManager.database.name` | string | `fm` | Database name |

| `federationManager.database.user` | string | `fm` | Database role |

## Reaching FM

- In the cluster: `http://federation-manager:8082`.

- In the cluster: `http://federation-manager:8082` (E/WBI) and `http://federation-manager-internal:8083`

  (internal API).

- On kind: `http://localhost:30989/docs` for the API docs.

## Troubleshooting

            - name: http

              containerPort: {{ $c.service.targetPort }}

              protocol: TCP

            - name: internal

              containerPort: {{ .Values.federationManager.internalService.targetPort }}

              protocol: TCP

          env:

            - name: FM_PORT

              value: {{ .Values.federationManager.service.targetPort | quote }}

            - name: FM_INTERNAL_PORT

              value: {{ .Values.federationManager.internalService.targetPort | quote }}

            - name: DB_PASSWORD

              valueFrom:

                secretKeyRef:

{{- if and .Values.federationManager.enabled (include "federation-manager.authEnabled" .) }}

# Cluster-internal only, whatever type the EWBI Service has: /internal/* has no auth of

# its own beyond being unreachable from outside.

apiVersion: v1

kind: Service

metadata:

  name: {{ .Values.federationManager.internalService.name }}

  namespace: {{ include "federation-manager.namespace" . }}

  labels:

    {{- include "federation-manager.fm.labels" . | nindent 4 }}

  {{- with .Values.commonAnnotations }}

  annotations:

    {{- toYaml . | nindent 4 }}

  {{- end }}

spec:

  type: ClusterIP

  ports:

    - name: internal

      protocol: TCP

      port: {{ .Values.federationManager.internalService.port }}

      targetPort: internal

  selector:

    {{- include "federation-manager.fm.selectorLabels" . | nindent 4 }}

{{- end }}

    targetPort: 8082

    nodePort: ""

  # FM's /internal/* API (partner registry, federation lifecycle) answers only on this

  # port, through a ClusterIP Service: OEG and operator tooling reach it inside the

  # cluster, and publishing the EWBI Service above never publishes it.

  internalService:

    name: federation-manager-internal

    port: 8083

    targetPort: 8083

  resources: {}

  database: