Version 10.0.1.x known limitations

If you suspect you are encountering this issue, verify it by running the following command:

kubectl -n <namespace> logs <new-ibm-apiconnect-pod-name> | grep "LockOwner"

If the lock is the problem, the log contains a message similar to the following example:

existing lock","LockOwner":"ibm-apiconnect-xxxxxx held by terminating pod

Resolve the issue by completing one of the following options:

• Force delete the terminating pod by running the following command:

  kubectl -n <namespace> delete pod <terminating-ibm-apiconnect-pod-name> --force --grace-period=0

  Kubernetes deletes the lock when the pod is deleted.

• Remove the lock manually by running the following command:

  kubectl delete cm ibm-apiconnect-lock

1. On your local file system, locate the autoproduct file called API-NAME-auto-product_API-VERSION.yaml.
2. Delete the file.
3. In API Designer, edit the newly imported API and activate it by clicking the Online toggle.

In general, it is best practice to activate an API using the Online toggle or by publishing the API with the Publish option.

• Developers that have been given only View permissions cannot see the Test tab in the API editor. For developers to be able to see the Test tab, they must be given a different permission level. For information about the default permission levels available, see API Connect user roles.
• Users with API-Drafts permissions, but who don't have any Sandbox Catalog permissions, cannot see the Test preferences in the Sandbox Catalog. For these users to be able to see the Test preferences, they must be given the Developer or Administrator role on the Sandbox Catalog.

• Reload the browser window.
• If there is still an issue, clear the browser cache and then log back in to the UI.
• Try using a private browser window.
• If possible, try a different browser type.

Workaround: To avoid this problem, select the Use all compatible gateway services target gateway option instead.

To work around the issue, check if the application already has a subscription to a different Plan in the same Product, as the test application can subscribe to only one Plan per Product. Then, either delete the additional subscriptions, or select a different Test application, and bring the API online again.

You can work around the incorrect link by clicking Manage and selecting the correct Catalog.

Work around: Either edit the new product, specify a gateway for the product, and then publish the API, or use an existing product to publish the API.

The workaround is included in the switch profiles steps for your deployment type:

• Kubernetes: Switching deployment profiles on Kubernetes
• VMware: Switching deployment profile on VMware
• OpenShift: Switching deployment profiles on OpenShift
• Cloud Pak for Integration: Changing the deployment profile on Cloud Pak for Integration

If you don't see an error message but suspect there is a problem, check the Product in API Manager to make sure it has a subscription. If there are no subscriptions, create one manually. This will activate the API and set it online. Then, when you view the API in API Designer, the status will be updated to show the API as Online.

You can avoid the error by manually refreshing the page to verify the invitation status before re-sending it.

The workaround is to edit the API definition's YAML file and remove the x-ibm-configuration.gateway setting.

The workaround is to edit the YAML file containing the Product definition and remove the duplicate entries.

oc get apiconnectcluster -n APIC_namespace

NAME   READY  STATUS    VERSION             RECONCILED VERSION   AGE
m1     admission webhook "vmanagementcluster.kb.io" denied the request: ManagementCluster.management.apiconnect.example.com "m1-mgmt" is invalid: [spec.databaseBackup.restartDB.accept: Invalid value: false: databaseBackup protocol has changed (from '' to 'objstore') and requires database restart. accept restartDB to restart database, spec.databaseBackup.restartDB.accept: Invalid value: false: databaseBackup configuration has changed and requires database restart. accept restartDB to restart database]   Pending   10.0.1.5-3388-eus   10.0.1.5-3388-eus    2d6h

The workaround is to using the 'Lax' SameSite Cookie attribute.

The v5-compatible gateway does not experience this limitation.

To resolve the error, follow the instructions in Troubleshooting Analytics start-up.

• Remove the rate limit definition from the OpenAPI source for the API. For example, if the source is in YAML format, remove the following lines:

  - name: graphql-input-type-cost
    operation: consume

• Edit the source for the Product and define a graphql-input-type-cost rate limit in all of the Plans that include the API.
  Note: You can edit only a manually created Product, not a Product that is generated by the automatic activation mechanism.

• On a Kubernetes deployment: Troubleshooting upgrades on Kubernetes
• On an OpenShift deployment: Troubleshooting installation and upgrade on OpenShift
• On a VMware deployment: Troubleshooting upgrades on VMware

For example, if you configure three different user registries for a particular Developer Portal site, the email address alice@acme.com can be used to log in to the site from only one of the user registries.

In addition, the catalog-operator in the OLM namespace will throw the following error:

sync "< namespace >" failed: found more than one head for channel

You can work around the error by completing the following steps:

• If the variable is stored as a Buffer (because the variable data was written as an XML string), an XML Nodelist is returned provided that contextname.headers.content-type is an XML type.
• If the variable is stored as a parsed XML Document (because the variable data was written as parsed XML, either as an XML document or an XML Nodelist), an XML document is returned.

With the DataPower API Gateway in IBM API Connect Version 10 however, the same function call always returns an XML Nodelist provided that contextname.headers.content-type is an XML type. Therefore, such an API developed for Version 2018.4.1 will fail in Version 10 if it is configured to expect an XML document, and will need to be reconfigured appropriately.

The problem does not occur with such an API migrated from IBM API Connect Version 5 because, with that release, apim.getvariable('context_name.body') also returns an XML Nodelist for XML payloads, nor does it occur if you are using the DataPower Gateway (v5 compatible).

context_name could be message, request, or the name of the output from an invoke policy.

1. Verify the names of the pending backup and operation lock by running the following commands:

   kubectl -n get mgmtb | grep Pending

   kubectl -n get cm | grep oplock

2. Delete the pending backup by running the following command:

   kubectl -n <namespace> delete mgmtb <name-of-backup>

3. Delete the operation lock by running the following command:

   kubectl -n <namespace> delete cm <name-of-lock>

Parser failed with error: syntax error, variables type is neither a JSON object nor null.

To resolve this problem, modify the query to remove the variable definitions before re-sending the HTTP request.

- Must validate at least one schema (anyOf) (context: (root).paths./example/types.post.parameters.0.schema.properties.items, line: 0, col: 0)
- Must validate one and only one schema (oneOf) (context: (root).paths./example/types.post.parameters.0, line: 46164, col: 21)
- paths./example/types.post.parameters.0.schema.properties.items.properties.pattern Does not match format 'regex' (context: (root).paths./example/types.post.parameters.0.schema.properties.items.properties.pattern, line: 0, col: 0)

WARN[2020-06-04T09:29:54-04:00] Leaving a placeholder OAuth Provider which must be replaced in draft API <api name>:
Unable to find an OAuth Provider to extract from Token URL or Authorization URL <api token/authorization URL> with
basePath /<base path> and scopes <scope list>.

A possible cause is that an OAuth provider matches the API path but is missing the necessary scopes. To resolve this problem, complete the following steps:

api_version: 2.0.0
name: name://../../../user-registries/<user_registry_name>/user-registry.yml
type: configured_api_user_registry
user_registry_url: file://../../../user-registries/<user_registry_name>/user-registry.yml

ErrorLog2020-06-02T08:35:37-04:00.log:ERRO[2020-06-02T08:36:07-04:00] unable to create User registry <user registry name>
ErrorLog2020-06-02T08:35:37-04:00.log:ERRO[2020-06-02T08:36:07-04:00] orgldap: An error occurred communicating with the ldap server at
'ldaps://<ldap-address>' (error: 'Error: self signed certificate in certificate chain').

To workaround this problem, for any artifacts, such as APIs or OAuth providers, that reference this user registry in their User Security section, replace the user registry with one that has been successfully migrated.

unable to create Oauth provider <provider name>
<provider name>: The expected path parameter 'tls-client-profile-id' is missing from the request URL.

unable to create Configured oauth provider <provider name>
<provider name>: The 'oauth_provider_url' property value '/api/orgs/<org>/oauth-providers/<provider name>' does not refer to a known Oauth Provider.

This is caused by an OAuth provider containing a custom HTML form in one or more User Security sections that specifies an ei-custom-form-tls-client-profile or an az-custom-form-tls-client-profile.

To resolve this problem, use the default TLS client profile by specifying a value of ''.

Cannot read property 'type' of null

To resolve this problem, remove any invalid OpenAPI YAML files from the startup directory, then restart the API Designer user interface.

• The ID Name field is required, but the API definition can be saved without entering a value in the field.
• The Secret Name field is required only when the Secret Required option is selected, but the user interface indicates that the Secret Name field is required regardless. Furthermore, when the field is required, the API definition can be save without entering a value.
• If the Authenticate Client Method is set to Third party, the User Registry Name field is required, but the API definition can be saved without entering a value in this field.

catalogs:
    apic-dev:
      properties:
        runtime-url: $(TARGET_URL)
    sb:
      properties:
        runtime-url: 'http://localhost:4001

You may also follow the instructions described here https://success.docker.com/article/how-to-setup-log-rotation-post-installation to set the maximum size of the log before it is rolled (max-size) and the maximum number of log files that can be present (max-files). More information about the Docker JSON File logging driver is available here: https://docs.docker.com/config/containers/logging/json-file/.

The changing of endpoints with APICUP after they have been configured in Cloud Manager is not supported. Any such endpoint changes will not be propagated to a running deployment.

For example, if an assembly includes a switch policy containing four redact conditions followed by an invoke policy, each redact condition redacts the response data. After porting to the API Gateway, the redact conditions remain inside the switch policy and target the message.body property for redaction. These redactions fail to execute because the message.body property has not yet been retrieved by the invoke policy. To correct this problem, you must move the invoke policy before the switch policy in the assembly.