Merge pull request #1 from docusign/remove-mock-endpoints

Remove mock endpoints

Author: karissarjacobsen

3. Docusign Extension App - Development Time/development-time.md

@@ -72,7 +72,7 @@ Now, let's create our first **Docusign Extension App**. Go to [**Docusign Develo
 
 ### Docusign Extension Apps and Data Input Output Extension
 
-The **Docusign Extension Apps** support [multiple extensions](https://developers.docusign.com/extension-apps/extension-apps-101/supported-extensions/). Out first one will based on [**Data IO**](https://developers.docusign.com/extension-apps/extension-app-reference/extension-contracts/data-io/), capable to read or write data from/to your system of record. Particularly, the **Extension App** read from and write data to a custom [**Maestro Workflow**](https://developers.docusign.com/docs/maestro-api/maestro101/workflows/)
+The **Docusign Extension Apps** support [multiple extensions](https://developers.docusign.com/extension-apps/extension-apps-101/supported-extensions/). Our first one will be based on [**Data IO**](https://developers.docusign.com/extension-apps/extension-app-reference/extension-contracts/data-io/), capable of reading or writing data from/to your system of record. Particularly, the **Extension App** reads from and writes data to a custom [**Workflow**](https://developers.docusign.com/docs/workflow-builder-api/workflow-builder101/workflows/)
 
 A **Data Input Output Extension App** defines 5 actions to be implemented:
 * Get Type Names
@@ -110,10 +110,4 @@ Click **App Testing** to test the application. For example, click **Run Test** f
 
 
 
-## Docusign Maestro
-
-
-
-asdasd
-asd
-asd
+## Docusign Workflow Builder

4. Docusign Extension App - Production Time/kong_identity.md

@@ -2,7 +2,7 @@
 
 Now, let's promote the **Extension App** to Production. That means we are going to add new components to our deployments:
 * Actual Data IO Services will be deployed so we can remove the **Kong Mocking Plugin**
-* Configure **Kong Identity** to play the Identity Provider role and implement the **Client Credentials Grant**
+* 0
 * Configure the **Extension App** to integration with **Kong Identity**
 
 Here's the new architecture

5. Docusign Extension App - Production time/deploy-app-to-aws-eks.md

@@ -0,0 +1,306 @@
+# Deploy Data IO App to AWS EKS and Integrate with Kong Data Plane
+
+This runbook deploys your local app folder to EKS and routes traffic through Kong Data Plane.
+
+## Scope
+
+This guide assumes:
+- EKS cluster and Kong Data Plane are already running from earlier docs.
+- Kong Identity is already configured.
+- Your app no longer exposes local oauth endpoints and only serves Data IO actions.
+
+Related docs in this repo:
+- ../1. AWS-EKS/aws-eks.md
+- ../2. Kong/kong.md
+- ./kong_identity.md
+
+## 1. Create the DynamoDB tables
+
+The app uses DynamoDB as its database. Create the required tables and grant the EKS pods access to them via IRSA (IAM Roles for Service Accounts) before deploying the app image.
+
+#### Create the tables
+
+The app expects three DynamoDB tables with these partition keys:
+- `Accounts` with `account_id` (string)
+- `Addresses` with `address_id` (string)
+
+```bash
+aws dynamodb create-table \
+  --table-name Accounts \
+  --attribute-definitions AttributeName=account_id,AttributeType=S \
+  --key-schema AttributeName=account_id,KeyType=HASH \
+  --billing-mode PAY_PER_REQUEST \
+  --region "$AWS_REGION"
+
+aws dynamodb create-table \
+  --table-name Addresses \
+  --attribute-definitions AttributeName=address_id,AttributeType=S \
+  --key-schema AttributeName=address_id,KeyType=HASH \
+  --billing-mode PAY_PER_REQUEST \
+  --region "$AWS_REGION"
+
+Wait until all tables are active:
+
+```bash
+aws dynamodb wait table-exists --table-name Accounts --region "$AWS_REGION"
+aws dynamodb wait table-exists --table-name Addresses --region "$AWS_REGION"
+
+aws dynamodb describe-table --table-name Accounts --region "$AWS_REGION" \
+  --query "Table.TableStatus"
+aws dynamodb describe-table --table-name Addresses --region "$AWS_REGION" \
+  --query "Table.TableStatus"
+```
+
+You should see:
+
+```
+"ACTIVE"
+```
+
+#### Create an IAM policy for DynamoDB access
+
+```bash
+aws iam create-policy \
+  --policy-name DocusignDataIODynamoDBPolicy \
+  --policy-document '{
+    "Version": "2012-10-17",
+    "Statement": [{
+      "Effect": "Allow",
+      "Action": [
+        "dynamodb:GetItem",
+        "dynamodb:PutItem",
+        "dynamodb:UpdateItem",
+        "dynamodb:DeleteItem",
+        "dynamodb:Query",
+        "dynamodb:Scan"
+      ],
+      "Resource": [
+        "arn:aws:dynamodb:'"$AWS_REGION"':'"$AWS_ACCOUNT_ID"':table/Accounts",
+        "arn:aws:dynamodb:'"$AWS_REGION"':'"$AWS_ACCOUNT_ID"':table/Addresses",
+      ]
+    }]
+  }'
+```
+
+#### Create an IRSA role and bind it to the app service account
+
+This allows the pods to access DynamoDB without embedding credentials.
+
+First, ensure the cluster has an IAM OIDC provider associated (required for IRSA):
+
+```bash
+eksctl utils associate-iam-oidc-provider --region "$AWS_REGION" --cluster kong313 --approve
+```
+
+Then create the service account:
+
+```bash
+eksctl create iamserviceaccount \
+  --cluster kong313 \
+  --region "$AWS_REGION" \
+  --namespace kong-apps \
+  --name docusign-dataio \
+  --attach-policy-arn "arn:aws:iam::${AWS_ACCOUNT_ID}:policy/DocusignDataIODynamoDBPolicy" \
+  --approve \
+  --override-existing-serviceaccounts
+```
+
+#### Verify the service account annotation
+
+```bash
+kubectl get serviceaccount docusign-dataio -n kong-apps -o jsonpath='{.metadata.annotations}' | jq
+```
+
+You should see an `eks.amazonaws.com/role-arn` annotation pointing to the newly created IAM role.
+
+## 2. Build and push the app image to ECR
+
+Run from repo root.
+
+```bash
+export AWS_REGION=us-west-2
+export AWS_ACCOUNT_ID=<YOUR_ACCOUNT_ID>
+export ECR_REPO=docusign-dataio
+
+aws ecr describe-repositories --repository-names "$ECR_REPO" --region "$AWS_REGION" >/dev/null 2>&1 || \
+aws ecr create-repository --repository-name "$ECR_REPO" --region "$AWS_REGION"
+
+aws ecr get-login-password --region "$AWS_REGION" | \
+docker login --username AWS --password-stdin "$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com"
+
+# --platform linux/amd64 is required when building on Apple Silicon (M1/M2/M3)
+# to ensure the image runs on x86_64 EKS nodes
+docker build --platform linux/amd64 -t "$ECR_REPO:latest" ./app
+
+docker tag "$ECR_REPO:latest" "$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/$ECR_REPO:latest"
+docker push "$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/$ECR_REPO:latest"
+```
+
+To redeploy after pushing an updated image, trigger a rolling restart:
+
+```bash
+kubectl -n kong-apps rollout restart deploy/docusign-dataio
+kubectl -n kong-apps rollout status deploy/docusign-dataio
+```
+
+## 3. Deploy the app to EKS
+
+Create namespace and deployment.
+
+```bash
+cat <<EOF | kubectl apply -f -
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kong-apps
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: docusign-dataio
+  namespace: kong-apps
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: docusign-dataio
+  template:
+    metadata:
+      labels:
+        app: docusign-dataio
+    spec:
+      serviceAccountName: docusign-dataio
+      containers:
+      - name: app
+        image: $AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/$ECR_REPO:latest
+        imagePullPolicy: Always
+        env:
+        - name: NODE_ENV
+          value: production
+        - name: PORT
+          value: "3000"
+        - name: AWS_REGION
+          value: "$AWS_REGION"
+        - name: DYNAMODB_TABLE_ACCOUNTS
+          value: "Accounts"
+        - name: DYNAMODB_TABLE_ADDRESSES
+          value: "Addresses"
+        ports:
+        - containerPort: 3000
+        readinessProbe:
+          tcpSocket:
+            port: 3000
+          initialDelaySeconds: 10
+          periodSeconds: 10
+        livenessProbe:
+          tcpSocket:
+            port: 3000
+          initialDelaySeconds: 20
+          periodSeconds: 20
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: docusign-dataio
+  namespace: kong-apps
+spec:
+  type: ClusterIP
+  selector:
+    app: docusign-dataio
+  ports:
+  - name: http
+    port: 3000
+    targetPort: 3000
+EOF
+```
+
+Check rollout.
+
+```bash
+kubectl -n kong-apps rollout status deploy/docusign-dataio
+kubectl -n kong-apps get pods -l app=docusign-dataio
+kubectl -n kong-apps get svc docusign-dataio
+```
+
+## 4. Configure Kong to route to the app service (remove mock plugin)
+
+Create a new decK file for production routing.
+
+```bash
+cat <<'EOF' > kong_docusign_openid_upstream.yaml
+_format_version: "3.0"
+services:
+- name: docusign-dataio
+  url: http://docusign-dataio.kong-apps.svc.cluster.local:3000
+  routes:
+  - name: docusign-dataio-route
+    paths:
+    - /
+    strip_path: false
+    plugins:
+    - name: openid-connect
+      instance_name: openid-connect-docusign-kong-identity
+      enabled: true
+      config:
+        issuer: ${{ env "DECK_ISSUER" }}
+        client_id:
+        - ${{ env "DECK_CLIENT_ID" }}
+        client_secret:
+        - ${{ env "DECK_CLIENT_SECRET" }}
+        auth_methods:
+        - introspection
+        introspection_endpoint: ${{ env "DECK_KONG_IDENTITY_INTROSPECTION_URL" }}
+EOF
+```
+
+Set env vars and sync config.
+
+```bash
+export DECK_ISSUER=$ISSUER_URL
+export DECK_KONG_IDENTITY_INTROSPECTION_URL=$ISSUER_URL/introspect
+export DECK_CLIENT_ID=$CLIENT_ID
+export DECK_CLIENT_SECRET=$CLIENT_SECRET
+
+deck gateway reset --konnect-control-plane-name kong-aws --konnect-token "$PAT" -f
+deck gateway sync --konnect-control-plane-name kong-aws --konnect-token "$PAT" kong_docusign_openid_upstream.yaml
+```
+
+## 5. Update manifest auth endpoints to Kong Identity
+
+Edit app/manifest.json.
+
+Set authentication connection customConfig values to Kong Identity, not your app:
+- tokenUrl: $ISSUER_URL/oauth/token
+- authorizationUrl: $ISSUER_URL/oauth/authorize
+
+Keep action URIs pointing to Kong Data Plane:
+- https://kong-dp.<your-domain>/api/dataio/createRecord
+- https://kong-dp.<your-domain>/api/dataio/patchRecord
+- https://kong-dp.<your-domain>/api/dataio/searchRecords
+- https://kong-dp.<your-domain>/api/dataio/getTypeNames
+- https://kong-dp.<your-domain>/api/dataio/getTypeDefinitions
+
+## 6. Validate through Kong Data Plane
+
+```bash
+export DATA_PLANE_LB=kong-dp.$AWS_DOMAIN
+
+curl -s -X POST "https://$DATA_PLANE_LB/api/dataio/getTypeNames" | jq
+curl -s -X POST "https://$DATA_PLANE_LB/api/dataio/getTypeDefinitions" | jq
+```
+
+Then run Extension App tests in the Docusign Developer Console.
+
+## 7. Rollback if needed
+
+If you need to temporarily return to mocks:
+
+```bash
+deck gateway sync --konnect-control-plane-name kong-aws --konnect-token "$PAT" kong_docusign_openid_mock.yaml
+```
+
+## Notes
+
+- This app now depends on Kong for auth enforcement.
+- Keep the app Service internal to the cluster.
+- DynamoDB access is granted via IRSA — no credentials are embedded in the deployment.