APIM EE - MongoDB

Deploys a full Gravitee API Management Enterprise Edition stack (Console, Portal, Gateway, and Management API) backed by MongoDB for persistence and Elasticsearch for analytics. The Kafka Gateway is enabled by default, allowing the APIM Gateway to act as a Kafka proxy — clients connect using the Kafka protocol via *.kafka.gck.local:9092 with TLS.

Install gck#

go install github.com/gravitee-io-labs/gck@latest

For other installation methods, see Installation .

This context uses DNS for host-based Kafka routing (*.kafka.gck.local). After creating the cluster, run the one-time OS setup so these hostnames resolve on your machine:

gck setup dns

The setup command requires sudo because it writes to system directories: /etc/resolver/ on macOS, and systemd-resolved configuration on Linux. Once done, day-to-day gck create and gck delete commands run without elevated privileges.

See the Networking guide for details.

Usage#

Create#

gck create --from gravitee-io/ee/apim/mongodb

Cleanup#

gck delete

Quick Start#

Sign in to the APIM Console at http://localhost:30080 with the default admin account (admin / admin).

To create your first API, follow the Gravitee APIM quick start guide .

Connecting a Kafka client#

Extract the TLS certificate from the running cluster:

kubectl get secret kafka-tls -n gravitee -o jsonpath='{.data.tls\.crt}' | base64 -d > kafka-tls.crt

Then configure your Kafka client properties:

security.protocol=SSL
ssl.truststore.type=PEM
ssl.truststore.location=/path/to/kafka-tls.crt
ssl.endpoint.identification.algorithm=

The ssl.endpoint.identification.algorithm must be set to empty because the self-signed certificate covers *.kafka.gck.local but broker metadata addresses use two-level subdomains (e.g. broker-0-acr.kafka.gck.local) that don’t match the single-level wildcard.

License#

This is an Enterprise Edition (EE) context. Place your Gravitee license key at $HOME/opt/gravitee/license.key and gck will automatically mount it into the cluster. If the file is missing, the license component is silently skipped (onMissing: ignore).

To use a different path, override it in your gck.yaml:

components:
  - name: license
    k8s:
      secrets:
        - name: gravitee-license
          fromFile: '/custom/path/to/license.key'