Known limitations

2023-04-28 11:11:49,258 INFO: Reaped pid=435,

If you encounter this issue, contact IBM Support for assistance.

If you suspect you are encountering this issue, verify it by running the following command:

kubectl -n <namespace> logs <new-ibm-apiconnect-pod-name> | grep "LockOwner"

If the lock is the problem, the log contains a message similar to the following example:

existing lock","LockOwner":"ibm-apiconnect-xxxxxx held by terminating pod

Resolve the issue by completing one of the following options:

• Force delete the terminating pod by running the following command:

  kubectl -n <namespace> delete pod <terminating-ibm-apiconnect-pod-name> --force --grace-period=0

  Kubernetes deletes the lock when the pod is deleted.

• Remove the lock manually by running the following command:

  kubectl delete cm ibm-apiconnect-lock

1. On your local file system, locate the autoproduct file called API-NAME-auto-product_API-VERSION.yaml.
2. Delete the file.
3. In API Designer, edit the newly imported API and activate it by clicking the Online toggle.

In general, it is best practice to activate an API using the Online toggle or by publishing the API with the Publish option.

• Developers that have been given only View permissions cannot see the Test tab in the API editor. For developers to be able to see the Test tab, they must be given a different permission level. For information about the default permission levels available, see API Connect user roles.
• Users with API-Drafts permissions, but who don't have any Sandbox Catalog permissions, cannot see the Test preferences in the Sandbox Catalog. For these users to be able to see the Test preferences, they must be given the Developer or Administrator role on the Sandbox Catalog.

• Reload the browser window.
• If there is still an issue, clear the browser cache and then log back in to the UI.
• Try using a private browser window.
• If possible, try a different browser type.

Workaround: To avoid this problem, select the Use all compatible gateway services target gateway option instead.

• clustermgmt:catAllocation
• clustermgmt:catIndices
• clustermgmt:catNodes
• clustermgmt:catRecovery
• clustermgmt:catShards
• clustermgmt:catAliases

• clustermgmt:getNodesHotThreads
• clustermgmt:getNodesHotThreadsById

• "X-BurstLimit-Limit"
• "X-BurstLimit-Remaining"

• "X-RateLimit-Limit"
• "X-RateLimit-Remaining"

Note that this limitation does not apply to assembly burst limits.

oc get apiconnectcluster -n APIC_namespace

NAME   READY  STATUS    VERSION             RECONCILED VERSION   AGE
m1     admission webhook "vmanagementcluster.kb.io" denied the request: ManagementCluster.management.apiconnect.example.com "m1-mgmt" is invalid: [spec.databaseBackup.restartDB.accept: Invalid value: false: databaseBackup protocol has changed (from '' to 'objstore') and requires database restart. accept restartDB to restart database, spec.databaseBackup.restartDB.accept: Invalid value: false: databaseBackup configuration has changed and requires database restart. accept restartDB to restart database]   Pending   10.0.1.5-3388-eus   10.0.1.5-3388-eus    2d6h

The workaround is to using the 'Lax' SameSite Cookie attribute.

• Remove the rate limit definition from the OpenAPI source for the API. For example, if the source is in YAML format, remove the following lines:

  - name: graphql-input-type-cost
    operation: consume

• Edit the source for the Product and define a graphql-input-type-cost rate limit in all of the Plans that include the API.
  Note: You can edit only a manually created Product, not a Product that is generated by the automatic activation mechanism.

When you configure the restore operation, set enableOverride: true but be aware that existing indices will be overwritten.

If you attempted a restore using enableOverride: false and the operation is stuck, then remove that job and start a new restore operation.

• On a Kubernetes deployment: Troubleshooting upgrades on Kubernetes
• On an OpenShift deployment: Troubleshooting installation and upgrade on OpenShift
• On a VMware deployment: Troubleshooting upgrades on VMware

For example, if you configure three different user registries for a particular Developer Portal site, the email address alice@acme.com can be used to log in to the site from only one of the user registries.

You can create and update user registries with the apic user-registries:create and apic user-registries:update commands. Both commands accept the external_group_mapping_enabled option. If you then create a configured user registry with the configured_catalog_user_registries:create command, the results depend on how you set the external_group_mapping_enabled option in the user registry.

Suppose you create a user registry (for example, call it UR) and you want to create a configured user registry (call it CUR) based on UR. Consider the following scenarios:

1. You create UR with the external_group_mapping_enabled: false. In this case, you can create your CUR based on that registry.

2. You create UR with external_group_mapping_enabled: true. In this case, you cannot base a configured user registry on it, so the creation of CUR fails.

3. You create UR with external_group_mapping_enabled: false and create CUR based on it, as in scenario 1. However, you then update UR and set external_group_mapping_enabled: true. In this case, you have a problem.
   The operation described in scenario 3 is not currently blocked, so you will successfully create an unsupported CUR and then run into errors when you attempt to onboard users. To resolve the issue, complete one of the following workarounds:

   • Update UR (the base user registry) and set external_group_mapping_enabled: false.
   • Leave UR with external_group_mapping_enabled: true but delete the configured registry (CUR) that is based on it.

• If the variable is stored as a Buffer (because the variable data was written as an XML string), an XML Nodelist is returned provided that contextname.headers.content-type is an XML type.
• If the variable is stored as a parsed XML Document (because the variable data was written as parsed XML, either as an XML document or an XML Nodelist), an XML document is returned.

With the DataPower API Gateway in IBM API Connect Version 10 however, the same function call always returns an XML Nodelist provided that contextname.headers.content-type is an XML type. Therefore, such an API developed for Version 2018.4.1 will fail in Version 10 if it is configured to expect an XML document, and will need to be reconfigured appropriately.

The problem does not occur with such an API migrated from IBM API Connect Version 5 because, with that release, apim.getvariable('context_name.body') also returns an XML Nodelist for XML payloads, nor does it occur if you are using the DataPower Gateway (v5 compatible).

context_name could be message, request, or the name of the output from an invoke policy.

1. Verify the names of the pending backup and operation lock by running the following commands:

   kubectl -n get mgmtb | grep Pending

   kubectl -n get cm | grep oplock

2. Delete the pending backup by running the following command:

   kubectl -n <namespace> delete mgmtb <name-of-backup>

3. Delete the operation lock by running the following command:

   kubectl -n <namespace> delete cm <name-of-lock>

Parser failed with error: syntax error, variables type is neither a JSON object nor null.

To resolve this problem, modify the query to remove the variable definitions before re-sending the HTTP request.

- Must validate at least one schema (anyOf) (context: (root).paths./example/types.post.parameters.0.schema.properties.items, line: 0, col: 0)
- Must validate one and only one schema (oneOf) (context: (root).paths./example/types.post.parameters.0, line: 46164, col: 21)
- paths./example/types.post.parameters.0.schema.properties.items.properties.pattern Does not match format 'regex' (context: (root).paths./example/types.post.parameters.0.schema.properties.items.properties.pattern, line: 0, col: 0)

WARN[2020-06-04T09:29:54-04:00] Leaving a placeholder OAuth Provider which must be replaced in draft API <api name>:
Unable to find an OAuth Provider to extract from Token URL or Authorization URL <api token/authorization URL> with
basePath /<base path> and scopes <scope list>.

A possible cause is that an OAuth provider matches the API path but is missing the necessary scopes. To resolve this problem, complete the following steps:

api_version: 2.0.0
name: name://../../../user-registries/<user_registry_name>/user-registry.yml
type: configured_api_user_registry
user_registry_url: file://../../../user-registries/<user_registry_name>/user-registry.yml

ErrorLog2020-06-02T08:35:37-04:00.log:ERRO[2020-06-02T08:36:07-04:00] unable to create User registry <user registry name>
ErrorLog2020-06-02T08:35:37-04:00.log:ERRO[2020-06-02T08:36:07-04:00] orgldap: An error occurred communicating with the ldap server at
'ldaps://<ldap-address>' (error: 'Error: self signed certificate in certificate chain').

To workaround this problem, for any artifacts, such as APIs or OAuth providers, that reference this user registry in their User Security section, replace the user registry with one that has been successfully migrated.

unable to create Oauth provider <provider name>
<provider name>: The expected path parameter 'tls-client-profile-id' is missing from the request URL.

unable to create Configured oauth provider <provider name>
<provider name>: The 'oauth_provider_url' property value '/api/orgs/<org>/oauth-providers/<provider name>' does not refer to a known Oauth Provider.

This is caused by an OAuth provider containing a custom HTML form in one or more User Security sections that specifies an ei-custom-form-tls-client-profile or an az-custom-form-tls-client-profile.

To resolve this problem, use the default TLS client profile by specifying a value of ''.

Cannot read property 'type' of null

To resolve this problem, remove any invalid OpenAPI YAML files from the startup directory, then restart the API Designer user interface.

• The ID Name field is required, but the API definition can be saved without entering a value in the field.
• The Secret Name field is required only when the Secret Required option is selected, but the user interface indicates that the Secret Name field is required regardless. Furthermore, when the field is required, the API definition can be save without entering a value.
• If the Authenticate Client Method is set to Third party, the User Registry Name field is required, but the API definition can be saved without entering a value in this field.

catalogs:
    apic-dev:
      properties:
        runtime-url: $(TARGET_URL)
    sb:
      properties:
        runtime-url: 'http://localhost:4001

You may also follow the instructions described here https://success.docker.com/article/how-to-setup-log-rotation-post-installation to set the maximum size of the log before it is rolled (max-size) and the maximum number of log files that can be present (max-files). More information about the Docker JSON File logging driver is available here: https://docs.docker.com/config/containers/logging/json-file/.

The changing of endpoints with APICUP after they have been configured in Cloud Manager is not supported. Any such endpoint changes will not be propagated to a running deployment.

For example, if an assembly includes a switch policy containing four redact conditions followed by an invoke policy, each redact condition redacts the response data. After porting to the API Gateway, the redact conditions remain inside the switch policy and target the message.body property for redaction. These redactions fail to execute because the message.body property has not yet been retrieved by the invoke policy. To correct this problem, you must move the invoke policy before the switch policy in the assembly.

/cloud/events?response_http_headers[X-Client-IP]=not:10.51.11.183&response_http_headers[X-Client-IP]=not:10.51.11.184

• You cannot extract or redact content from the same source that is defined in the root. For example, if the root is defined as message.body.a, the action fails if the content to extract or redact is defined as the entire input.

  As a workaround, remove the last element of the root and define that element as the content to extract or redact. For the previous example, define root as message.body and the content as a.

• New JSON objects cannot be constructed from the capture field that is specified in an Extract policy. As a workaround, use the transform expression $merge([]) to construct the empty object. You can then specify more extracts as needed for key-value pairs.
• If soft linked copies of a field exist in different locations, an Extract or Redaction policy can cause content from all of the linked fields to be extracted or redacted. As a workaround for the Extract policy, use the $merge($spread($)) object function to construct new, unlinked objects and arrays. For example, the following transform expressions construct unlinked copies of the field c.

  \"a\": $merge($spread($.c)
  \"b\": $merge($spread($.c)