Map every user-facing 3scale API Management feature to its equivalent in the OpenShift + RHCL stack, clearly identifying which layer provides the capability, which job it serves, and where to find documentation and examples.
Reference: Red Hat 3scale API Management 2.16 Documentation
| # | Job | Sections |
|---|---|---|
| 1 | When I have backend services, I want to expose them through a single managed entry point, so consumers have a stable URL regardless of backend changes. | Routing, Lifecycle, Policies |
| 2 | When I deploy a new API version, I want to shift traffic gradually between versions, so I can roll back without downtime if something breaks. | Routing, Lifecycle, Multi-cluster |
| 3 | When my API serves multiple audiences, I want to route requests to different backends based on path, headers, or method, so each consumer reaches the right service. | Routing, Lifecycle, Policies |
| 4 | When my backend URLs change, I want to rewrite incoming request paths at the gateway, so consumers don't need to update their integrations. | Routing, Policies |
| 5 | When I publish an API, I want to require credentials on every request, so only authorized consumers can access my service. | Auth, Policies, Operations, Security |
| 6 | When a consumer authenticates via our identity provider, I want to validate their token at the gateway, so requests with expired or forged tokens never reach my backend. | Auth, Policies |
| 7 | When different consumers have different permission levels, I want to enforce authorization rules based on token claims, so each consumer can only access what they're entitled to. | Auth, Policies |
| 8 | When I run a browser-facing application, I want to handle the full OIDC login flow at the gateway, so my application doesn't need to implement authentication itself. | Auth |
| 9 | When I need to restrict API access by network origin, I want to allowlist or denylist IP ranges at the gateway, so I can enforce network-level access policy. | Auth, Policies, Security |
| 10 | When traffic flows between my services, I want to encrypt it automatically, so I meet zero-trust and compliance requirements without changing application code. | Auth, Policies, Security |
| 11 | When I expose APIs over HTTPS, I want certificates to be issued and renewed automatically, so I never have an outage from an expired cert. | Policies, Security |
| 12 | When my API has finite capacity, I want to limit how many requests each consumer can make, so no single consumer degrades the experience for others. | Rate Limiting, Policies |
| 13 | When I offer tiered service levels, I want to apply different rate limits per tier, so premium consumers get higher throughput than free-tier ones. | Rate Limiting, Plans |
| 14 | When rate limits are applied, I want to include remaining-quota headers in responses, so consumers can self-throttle before hitting the limit. | Rate Limiting |
| 15 | When I serve AI/LLM workloads, I want to rate-limit based on token consumption rather than request count, so limits reflect actual resource usage. | Rate Limiting |
| 16 | When I have internal APIs that other teams need, I want to package them as discoverable products with documentation, so developers can find and understand my APIs without asking me. | Plans, Portal, Lifecycle, Operations |
| 17 | When I offer multiple service tiers, I want to define plans with different limits and features, so consumers choose the level that fits their needs. | Plans |
| 18 | When a consumer requests access to my API, I want to review and approve their request before granting credentials, so I control who uses my service. | Plans, Portal |
| 19 | When I'm a developer who needs to integrate with an internal API, I want to browse a catalog of available APIs, so I can find the right one without emailing around. | Portal |
| 20 | When I find an API I need, I want to request access and receive credentials through self-service, so I don't wait on another team's backlog. | Portal |
| 21 | When I have API credentials, I want to see interactive documentation and try endpoints, so I can validate my integration before writing code. | Portal, Lifecycle |
| 22 | When I'm using an API, I want to see my current usage and remaining quota, so I can plan my consumption. | Analytics, Policies |
| 23 | When my API is in production, I want to see request volume, latency, and error rates, so I know if the service is healthy. | Analytics, Policies, Operations |
| 24 | When usage patterns change, I want to get alerts before my API is overwhelmed, so I can scale or investigate proactively. | Analytics |
| 25 | When a request fails, I want to trace it end-to-end through the gateway and backends, so I can pinpoint where the failure occurred. | Analytics |
| 26 | When I run the same API across multiple clusters, I want to have a single hostname that routes to the nearest healthy cluster, so consumers get low latency and automatic failover. | Routing, Multi-cluster |
| 27 | When a cluster goes down, I want traffic to automatically shift to the remaining clusters, so there is no consumer-facing outage. | Multi-cluster |
| 28 | When I serve a global audience, I want to route users to the geographically closest cluster, so latency is minimized. | Multi-cluster |
| 29 | When I provide APIs as a paid service, I want to charge consumers based on their usage, so my API program generates revenue. | Billing |
| 30 | When billing is active, I want to generate invoices automatically, so I don't manually track and bill each consumer. | Billing |
| 31 | When I manage APIs across teams, I want to define all configuration as code in Git, so changes go through review, are auditable, and can be rolled back. | Operations |
| 32 | When multiple teams share a cluster, I want to isolate their API configurations from each other, so one team's changes can't break another team's APIs. | Portal, Operations, Security |
| 33 | When I need to audit API access, I want to see who accessed what and when, so I can satisfy compliance requirements. | Policies, Operations, Security |
| Layer | Components | What it provides |
|---|---|---|
| RHCL | Kuadrant Operator, Authorino, Limitador, DNS Operator | Auth, rate limiting, DNS, TLS policy, API products |
| Gateway API | Gateway, HTTPRoute, GRPCRoute CRs | Routing, traffic matching, URL rewriting, header filters |
| Envoy/Istio | Envoy proxy, Istio control plane (OSSM) | Data plane, CORS, WebSocket, HTTP/2, access logging, circuit breaking, mTLS mesh, load balancing |
| OpenShift | OCP platform, OLM, OAuth, RBAC, Prometheus | Platform auth, monitoring, secrets, backup, namespace isolation |
| RHDH | Red Hat Developer Hub + Kuadrant plugin | Developer portal, API catalog, onboarding |
| cert-manager | cert-manager operator | Certificate issuance and rotation (used by RHCL TLSPolicy) |
| 3scale Feature | Equivalent | Layer | Jobs | Examples & Docs |
|---|---|---|---|---|
| APIcast gateway (Nginx-based) | Istio/Envoy gateway | Envoy/Istio | 1 | OSSM 3.2 Gateways guide |
| Products & backends (routing to upstream) | Gateway + HTTPRoute CRs | Gateway API | 1, 3 | HTTPRoute YAML · Gateway API routing guide |
| Mapping rules (path/method → metric) | HTTPRoute match rules (routing) + RateLimitPolicy descriptors (metrics) | Gateway API + RHCL | 3 | HTTPRoute API type — note: 3scale mapping rules combine routing with hit counting; in RHCL these are separate concerns |
| Staging & production environments | Separate Gateway instances per environment | Gateway API | 2 | Traffic splitting guide — note: no built-in promotion workflow like 3scale; use GitOps for environment promotion |
| Custom domains / public base URL | Gateway listener hostnames | Gateway API | 1 | Gateway API type |
| DNS record management | DNSPolicy CR | RHCL | 1, 26 | RHCL DNS guide · DNSPolicy YAML |
| Path-based routing | HTTPRoute path matching | Gateway API | 3 | HTTP routing guide |
| Header-based routing | HTTPRoute header matching | Gateway API | 3 | HTTP routing guide |
| URL rewriting policy | HTTPRoute URL rewrite filters | Gateway API | 4 | URL rewrite guide |
| URL rewriting with regex captures | HTTPRoute URL rewrite filter | Gateway API | 4 | URL rewrite guide |
| Proxy caching policy | — | Gap | — | Envoy has an experimental cache filter but it is not configurable via OSSM or RHCL and is not supported |
| gRPC support | GRPCRoute CR | Gateway API | 1, 3 | gRPC AuthPolicy example · GRPCRoute API |
| WebSocket support | Envoy WebSocket upgrade | Envoy/Istio | 1 | Envoy WebSocket docs |
| HTTP/2 support | Gateway listener protocol | Envoy/Istio | 1 | Gateway API listener config |
| Request/response size limits | Envoy per_connection_buffer_limit_bytes |
Envoy/Istio | — | Envoy listener config |
| 3scale Feature | Equivalent | Layer | Jobs | Examples & Docs |
|---|---|---|---|---|
| API key authentication | AuthPolicy with API key identity | RHCL | 5 | RHCL auth guide · AuthPolicy YAML · Authorino API key guide |
| App ID / App Key pair | AuthPolicy with credential extraction | RHCL | 5 | Passing credentials guide — note: partial; 3scale validates two paired credentials (app_id + app_key). Authorino extracts a single credential per identity source. Pairing requires custom metadata/authorization logic |
| OpenID Connect (OIDC) integration | AuthPolicy with JWT/OIDC issuer | RHCL | 6, 7 | Authorino OIDC JWT guide · JWT+K8s AuthZ YAML |
| OIDC Authorization Code Flow (browser) | OIDCPolicy extension (Tech Preview) | RHCL | 8 | OIDCPolicy Keycloak guide · OIDCPolicy YAML — Tech Preview in RHCL 1.4; browser apps only, no implicit/hybrid flows |
| OAuth 2.0 token introspection | AuthPolicy with OAuth2 introspection | RHCL | 6 | Authorino OAuth2 introspection guide |
| JWT claim validation | AuthPolicy pattern matching on claims | RHCL | 7 | Authorino OIDC RBAC guide · JSON pattern matching guide |
| Keycloak / RH-SSO integration | AuthPolicy OIDC issuerUrl | RHCL | 6, 8 | OIDCPolicy Keycloak guide |
| Referrer filtering | AuthPolicy CEL predicate on Referer header | RHCL | 9 | CEL introduction — note: partial; 3scale validates referrer per-application against a whitelist. CEL can check the header value but doesn't tie it to application identity |
| IP allowlist / denylist | AuthPolicy CEL predicate on source IP | RHCL | 9 | CEL predicate example |
| Anonymous access | AuthPolicy anonymous identity | RHCL | — | Anonymous access guide |
| Mutual TLS (client certificates) | AuthPolicy X.509 client cert auth | RHCL | 5, 10 | X.509 auth guide · X.509 AuthPolicy YAML |
| Auth response header injection | AuthPolicy response headers | RHCL | 7 | Authorino injecting data guide |
| Credential location config (header, query, cookie) | AuthPolicy credential extraction | RHCL | 5 | Passing credentials guide |
| OPA/Rego authorization | AuthPolicy with OPA | RHCL | 7 | Authorino OPA guide |
| Kubernetes RBAC authorization | AuthPolicy with SubjectAccessReview | RHCL | 7 | Authorino K8s SAR guide |
| Service mesh mTLS (pod-to-pod) | PeerAuthentication | Envoy/Istio | 10 | OSSM 3.0 security docs · Istio PeerAuthentication |
| Upstream mTLS (gateway to backend) | DestinationRule TLS settings | Envoy/Istio | 10 | Istio DestinationRule |
| 3scale Feature | Equivalent | Layer | Jobs | Examples & Docs |
|---|---|---|---|---|
| Application plan rate limits | RateLimitPolicy CR | RHCL | 12, 13 | RHCL full walkthrough · RLP Gateway YAML |
| Per-method / per-metric limits | RateLimitPolicy CEL-based counters | RHCL | 12 | Simple RL guide · RLP HTTPRoute YAML |
| Rate limit headers (RateLimit-Limit, -Remaining, -Reset) | Limitador response headers | RHCL | 14 | RateLimitPolicy reference |
| Soft vs hard limits | RateLimitPolicy (hard limits only) | RHCL | 12 | RateLimitPolicy reference — note: partial; 3scale soft limits log/report without blocking. RHCL only has hard limits (429 on exceeded). Soft limit behavior requires custom Prometheus alerts on approaching thresholds |
| 3scale batcher policy (high throughput) | Limitador sync period config | RHCL | 12 | Limitador docs |
| Spike control / retry-after | RateLimitPolicy | RHCL | 12 | RateLimitPolicy reference — note: Limitador returns RateLimit headers but does not set Retry-After automatically |
| Token-based rate limiting (AI/LLM) | TokenRateLimitPolicy CR | RHCL | 15 | Token RL tutorial · TRLP YAML |
| Retry on failure | HTTPRoute retry config | Gateway API | — | Gateway API GEP-1731 (Experimental) |
| Circuit breaking | Istio DestinationRule | Envoy/Istio | 12 | Istio circuit breaking |
| Connection timeouts | HTTPRoute/Gateway timeout config | Gateway API | — | Gateway API timeouts |
| Connection pooling / max connections | Istio DestinationRule | Envoy/Istio | — | Istio DestinationRule |
| Load balancing algorithms | Istio DestinationRule | Envoy/Istio | — | Istio load balancing |
| 3scale Feature | Equivalent | Layer | Jobs | Examples & Docs |
|---|---|---|---|---|
| Application plans (free, basic, premium) | PlanPolicy extension | RHCL | 13, 17 | PlanPolicy design doc |
| Plan approval modes (auto, manual) | APIProduct CR approvalMode |
RHCL | 18 | Console plugin overview |
| Feature visibility per plan | — | Gap | 17 | 3scale can show/hide API methods per plan. PlanPolicy controls rate limits per tier but does not control endpoint visibility. No equivalent for hiding endpoints based on plan |
| Plan-based rate limits | PlanPolicy + RateLimitPolicy | RHCL | 13, 17 | Authenticated RL guide |
| Trial periods | — | Gap | 17 | — |
| Plan change workflows | — | Gap | 17 | — |
| 3scale Feature | Equivalent | Layer | Jobs | Examples & Docs |
|---|---|---|---|---|
| Traffic analytics dashboard | Custom Grafana dashboards (no pre-built) | OpenShift | 23 | OCP monitoring guide — note: 3scale includes built-in analytics dashboards. RHCL requires building custom Grafana dashboards from Prometheus metrics |
| Per-application usage tracking | Kuadrant/Authorino/Limitador metrics | RHCL + OpenShift | 22, 23 | RHCL observability guide — note: metrics are per-policy, not per-application. The 3scale concept of "application" doesn't exist natively; tracking per consumer requires custom metric labels |
| Response code analytics | Envoy access logs | Envoy/Istio | 23 | OSSM 3.0 Observability · Istio Telemetry API |
| Response code aggregation | Prometheus queries | OpenShift | 23 | OCP monitoring guide |
| Top applications report | Custom Grafana dashboards | OpenShift | 23 | OCP monitoring guide |
| Daily/weekly/monthly aggregation | Prometheus recording rules | OpenShift | 23 | Prometheus recording rules |
| Alerts on usage thresholds | Prometheus alerting rules | OpenShift | 24 | OCP managing alerts guide |
| 3scale analytics API | Prometheus API | OpenShift | 23 | Prometheus HTTP API |
| Real-time usage dashboard | Grafana + Prometheus | OpenShift | 22, 23 | OCP monitoring guide |
| Distributed tracing | Jaeger / Tempo via Istio | Envoy/Istio + OpenShift | 25 | OSSM 3.0 Observability · Istio distributed tracing |
| 3scale Feature | Equivalent | Layer | Jobs | Examples & Docs |
|---|---|---|---|---|
| Pricing rules per metric | — | Gap | 29 | — |
| Automated billing / invoicing | — | Gap | 30 | — |
| Credit card integration (Stripe, Braintree) | — | Gap | 29 | — |
| Pre-paid / post-paid billing | — | Gap | 29 | — |
| Invoice management | — | Gap | 30 | — |
Billing is the largest functional gap. RHCL does not include billing capabilities. Customers needing monetization should integrate external billing systems (Stripe, Zuora, etc.) with Kuadrant usage metrics exported via Prometheus. The metrics are available (jobs 22, 23) — the billing logic is not (jobs 29, 30).
| 3scale Feature | Equivalent | Layer | Jobs | Examples & Docs |
|---|---|---|---|---|
| Self-service developer portal (CMS) | RHDH with Kuadrant plugin | RHDH | 19 | Kuadrant RHDH plugin · RHDH plugin config guide |
| Developer self-registration | RHDH user authentication + APIKey self-service via console plugin | RHDH + RHCL | 20 | RHDH plugin install guide — note: partial; 3scale has a dedicated sign-up page for API consumers. RHDH authenticates users but doesn't have an API-consumer-specific registration flow. API key requests are done via OCP console plugin |
| Application management (create, list, delete) | APIProduct / APIKey CRs | RHCL | 16, 20 | Console plugin overview |
| API key provisioning & retrieval | APIKey CR workflow | RHCL | 20 | Console plugin overview |
| API key approval workflow | APIKeyRequest / APIKeyApproval CRs | RHCL | 18 | Developer portal controller |
| Interactive API docs (ActiveDocs/Swagger) | OpenAPI specs in RHDH | RHDH | 21 | RHDH plugin config guide |
| Custom portal theming/branding | RHDH theming (limited) | RHDH | 19 | RHDH plugin config guide — note: partial; RHDH supports logo/color theming. 3scale's CMS allows full HTML/CSS/JS customization with Liquid templates |
| Portal CMS (pages, layouts, partials) | — | Gap | 19 | — |
| Email notifications | — | Gap | 18, 20 | — |
| Social login (GitHub, Auth0) | RHDH auth providers | RHDH | 20 | RHDH plugin config guide |
| Multi-tenant portal | RHDH multi-tenancy | RHDH | 32 | RHDH plugin config guide |
| Forum / community features | — | Gap | 19 | — |
| 3scale Feature | Equivalent | Layer | Jobs | Examples & Docs |
|---|---|---|---|---|
| API Products (bundling backends) | APIProduct CR | RHCL | 16 | Console plugin overview · Developer portal controller |
| API versioning | HTTPRoute path/header versioning | Gateway API | 2 | HTTP routing guide |
| Publishing lifecycle (draft → published → deprecated → retired) | APIProduct publishStatus field (draft/published only) |
RHCL | 16 | Console plugin overview — note: partial; APIProduct supports draft and published states. Deprecated/retired lifecycle states are not implemented |
| Service discovery (OpenShift) | Kubernetes Services | OpenShift | 1 | K8s Service docs |
| API documentation hosting | APIProduct documentation links + RHDH | RHCL + RHDH | 16, 21 | RHDH plugin config guide |
| Backend-to-product mapping | HTTPRoute backendRefs | Gateway API | 1, 3 | HTTPRoute YAML |
| Canary / blue-green deployments | HTTPRoute traffic weights | Gateway API | 2 | Traffic splitting guide |
| API deprecation notices | — | Gap | 16 | — |
| 3scale Policy | Equivalent | Layer | Jobs | Examples & Docs |
|---|---|---|---|---|
| 3scale Auth Caching | Authorino built-in caching | RHCL | 6 | Authorino caching docs |
| 3scale Referrer | AuthPolicy CEL predicate | RHCL | 9 | CEL introduction |
| Anonymous Access | AuthPolicy anonymous identity | RHCL | — | Anonymous access guide |
| Camel Service | HTTPRoute to Camel backend | Gateway API | 3 | HTTPRoute backendRefs |
| Conditional Policy | AuthPolicy/RateLimitPolicy when conditions |
RHCL | 7, 12 | CEL predicate example · AuthPolicy reference |
| Content Caching | — | Gap | — | Same as proxy caching — Envoy filter exists but is not supported via OSSM/RHCL |
| CORS Request Handling | Envoy CORS filter | Envoy/Istio | — | Istio CorsPolicy |
| Custom Metrics | RateLimitPolicy descriptors | RHCL | 12, 22 | RateLimitPolicy reference |
| Echo | — | Gap | — | — |
| Edge Limiting | RateLimitPolicy | RHCL | 12 | Gateway RL guide |
| Header Modification (auth-related) | AuthPolicy response headers | RHCL | 7 | Authorino injecting data guide |
| Header Modification (non-auth) | HTTPRoute request/response header filters | Gateway API | 4 | Header modifier guide |
| HTTP/2 | Gateway listener protocol | Envoy/Istio | 1 | Gateway API listener config |
| IP Check | AuthPolicy CEL predicate | RHCL | 9 | CEL introduction |
| JWT Claim Check | AuthPolicy JWT + pattern matching | RHCL | 7 | Authorino OIDC RBAC guide |
| Liquid Context Debug | — | Gap | — | — |
| Logging (access logs) | Istio Telemetry CR / Envoy access log | Envoy/Istio | 23, 33 | Istio access logging |
| Maintenance Mode | — | Gap | — | Gateway API does not have a standard direct-response filter. Would require implementation-specific extension or EnvoyFilter |
| OAuth 2.0 Mutual TLS | AuthPolicy mTLS + OAuth2 | RHCL | 5, 10 | Authorino mTLS guide |
| OAuth 2.0 Token Introspection | AuthPolicy OAuth2 introspection | RHCL | 6 | Authorino OAuth2 introspection guide |
| On Fail (failure mode) | AuthPolicy/RateLimitPolicy failure modes (per-evaluator) | RHCL | 5, 12 | AuthPolicy reference — note: 3scale's On Fail controls the entire policy chain. RHCL failure modes are per-evaluator, not a global chain-level setting |
| Proxy Service | HTTPRoute backendRefs | Gateway API | 1 | HTTPRoute YAML |
| Retry | HTTPRoute retry config | Gateway API | — | Gateway API GEP-1731 (Experimental) |
| Routing | HTTPRoute match rules | Gateway API | 3 | HTTP routing guide |
| SOAP | — | Gap | — | — |
| TLS Termination | TLSPolicy CR | RHCL | 11 | TLS guide · TLSPolicy YAML |
| TLS certificate provisioning | cert-manager operator | cert-manager | 11 | cert-manager OCP docs |
| Upstream | HTTPRoute backendRefs | Gateway API | 1 | HTTPRoute YAML |
| Upstream Connection (timeouts, buffering) | HTTPRoute/Gateway timeouts | Gateway API | — | Gateway API timeouts |
| Upstream Mutual TLS | Istio PeerAuthentication + DestinationRule | Envoy/Istio | 10 | Istio mTLS guide |
| URL Rewriting | HTTPRoute URL rewrite filter | Gateway API | 4 | URL rewrite guide |
| URL Rewriting with Captures | HTTPRoute URL rewrite filter | Gateway API | 4 | URL rewrite guide |
| WebSocket | Envoy WebSocket upgrade | Envoy/Istio | 1 | Envoy WebSocket docs |
| 3scale Feature | Equivalent | Layer | Jobs | Examples & Docs |
|---|---|---|---|---|
| Admin portal (web UI) | OCP console plugin for RHCL | RHCL + OpenShift | 16, 23 | Console plugin overview |
| Admin SSO | OpenShift OAuth / OIDC | OpenShift | 33 | OCP identity providers |
| Admin RBAC | OpenShift ClusterRoles + RoleBindings | OpenShift | 32 | OCP RBAC docs |
| Multi-tenancy | Namespace-based isolation | OpenShift | 32 | OCP projects docs |
| Operator-based deployment | Kuadrant Operator via OLM | RHCL + OpenShift | 31 | RHCL install guide |
| CLI tooling (3scale toolbox) | kubectl/oc + CRDs | OpenShift | 31 | AuthPolicy YAML · RLP YAML |
| API-as-code (CRDs) | Native — all config is CRDs | RHCL + Gateway API | 31 | RHCL full walkthrough |
| Backup & restore | Velero / OADP | OpenShift | 31 | OADP backup guide |
| GitOps workflows | ArgoCD / OpenShift GitOps | OpenShift | 31 | OpenShift GitOps docs |
| Secret management | Kubernetes Secrets | OpenShift | 5 | OCP secrets guide |
| 3scale Feature | Equivalent | Layer | Jobs | Examples & Docs |
|---|---|---|---|---|
| TLS termination at gateway | TLSPolicy CR + Gateway TLS config | RHCL + Gateway API | 11 | TLS guide · TLSPolicy YAML |
| Automated certificate management | TLSPolicy + cert-manager | RHCL + cert-manager | 11 | cert-manager OCP docs |
| Bot detection | AuthPolicy CEL predicates | RHCL | 9 | CEL introduction |
| Threat protection | ThreatPolicy extension (future) | RHCL | — | — |
| Secret management | Kubernetes Secrets | OpenShift | 5 | OCP secrets guide |
| SSRF protection | Authorino URL validation | RHCL | 10 | Authorino PR #621 |
| Pod-to-pod encryption (mesh mTLS) | Istio PeerAuthentication | Envoy/Istio | 10 | Istio mTLS guide |
| Network policies | OpenShift NetworkPolicy | OpenShift | 10, 32 | OCP NetworkPolicy docs |
| Audit logging | OpenShift audit logs + Envoy access logs | OpenShift + Envoy/Istio | 33 | OCP audit log config · Istio access logging |
| 3scale Feature | Equivalent | Layer | Jobs | Examples & Docs |
|---|---|---|---|---|
| Multi-environment promotion | Multi-cluster Gateway + DNSPolicy | RHCL + Gateway API | 2, 26 | Load-balanced DNS guide |
| Custom domain management | DNSPolicy CR | RHCL | 1, 26 | Basic DNS guide · DNSPolicy YAML |
| Geographic routing | DNSPolicy geo routing | RHCL | 28 | Load-balanced DNS guide |
| Health-based failover | DNSPolicy health checks | RHCL | 27 | DNS health checks guide · Health check YAML |
| Weighted load balancing across clusters | DNSPolicy weighted routing | RHCL | 26 | Load-balanced DNS guide |
Multi-cluster DNS and traffic management is a significant advantage of RHCL over 3scale. 3scale had no equivalent to DNSPolicy's automated multi-cluster DNS with geo routing, health checks, and failover (jobs 26-28).
| Gap | Affected Jobs | Workaround |
|---|---|---|
| Billing, invoicing, monetization | 29, 30 | Integrate external billing (Stripe, Zuora) with Prometheus usage metrics |
| Proxy caching (application-level) | — | Envoy has an experimental cache filter but it is not supported via OSSM/RHCL |
| SOAP protocol support | — | Use Camel K as a SOAP-to-REST bridge behind HTTPRoute |
| Maintenance mode (static responses) | — | Gateway API has no standard direct-response filter; requires EnvoyFilter |
| Feature visibility per plan | 17 | PlanPolicy controls rate limits per tier but cannot show/hide endpoints |
| Soft limits (warn without blocking) | 12 | RHCL only has hard limits (429). Use Prometheus alerts for approaching-threshold warnings |
| Email notifications | 18, 20 | External email service + webhook integration |
| Trial period management | 17 | Manual process or custom controller |
| Plan change workflows | 17 | Manual process or custom controller |
| Full developer portal CMS | 19 | RHDH covers API catalog/keys but is not a CMS |
| 3scale Analytics API | 23 | Prometheus API provides equivalent data, different format |
| Echo policy (debug) | — | kubectl run with curl for ad-hoc testing |
| Liquid Context Debug | — | No equivalent — use Envoy access logs for debugging |
| API deprecation signaling | 16 | Manual — update APIProduct description/status |
| Advantage | Layer | Relevant Jobs |
|---|---|---|
| Gateway API native (portable across implementations) | Gateway API | 1, 3 |
| Multi-cluster DNS with geo/weighted routing and failover | RHCL | 26, 27, 28 |
| CEL-based policy expressions (more flexible than policy chain) | RHCL | 7, 9, 12 |
| Token-based rate limiting for AI/LLM workloads | RHCL | 15 |
| OPA/Rego authorization policies | RHCL | 7 |
| Kubernetes-native operations (GitOps, CRDs, RBAC) | OpenShift + RHCL | 31, 32 |
| TLS automation with cert-manager | RHCL + cert-manager | 11 |
| Distributed tracing (Jaeger/Tempo) | Envoy/Istio + OpenShift | 25 |
| Service mesh features (circuit breaking, mTLS, load balancing) | Envoy/Istio | 10, 12 |
| Pod-to-pod encryption (zero-trust networking) | Envoy/Istio | 10 |
| Status | Jobs | Count |
|---|---|---|
| Fully covered | 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 14, 15, 23, 24, 25, 26, 27, 28, 31, 32, 33 | 23 |
| Partially covered | 13 (plans TP), 16 (no deprecation), 17 (no trials/plan changes), 18 (no email), 19 (no CMS), 20 (no email), 21 (RHDH only), 22 (metrics yes, self-service dashboard limited) | 8 |
| Not covered | 29, 30 (billing/monetization) | 2 |