Migration Overview: Why Move from 3scale to Connectivity Link?

Estimated time: ~15 minutes

Learning objectives

  • Map core 3scale concepts to Connectivity Link / Kuadrant equivalents

  • Explain why organizations adopt Gateway API and GitOps-native policies

  • Recognize features this workshop intentionally does not migrate 1:1

Introduction

Red Hat 3scale API Management has been the standard platform for managing APIs on OpenShift. Red Hat Connectivity Link (powered by Kuadrant) represents the next generation — a Kubernetes-native approach that uses the Gateway API standard, GitOps, and declarative CRDs instead of a separate management plane.

This module introduces the key concepts of both products and explains why organizations are migrating. The lab is built around four strategies to get there — not one tool.

The strategy set (keep this mental model)

Strategy One-line pitch

Developer Hub — Golden Path

Software Template → Git → Argo CD → Kuadrant. Self-service GitOps; primary hands-on path in this workshop (module 7).

Kuadrant Console

Operate API Products, keys, traffic, and Swagger after (or alongside) migration (module 11).

Migration Toolkit

Guided discovery from a live 3scale Admin API into Connectivity Link config (module 12).

APIShift

Same migration core as the Toolkit + AI assist + register into Developer Hub (module 13).

You will explore source and target first (modules 3–6), then execute the Golden Path and the UIs. See the Home strategies table for the full first-impression map.

3scale concepts

Concept Definition

Product

A logical API definition that groups backend APIs, authentication settings, and application plans.

Backend

An internal API endpoint (private base URL) that 3scale routes traffic to.

MappingRule

A pattern-based routing rule that maps HTTP method + URL path to a metric.

APIcast

The 3scale API gateway based on NGINX/OpenResty. Handles authentication, rate limiting, and proxying. Docs: Red Hat 3scale.

Application Plan

Defines rate limits, quotas, and pricing tiers for API consumers.

Application

An API consumer identity bound to a plan. Holds user_key (API Key) or client_id/client_secret (OIDC).

ActiveDoc

An OpenAPI specification attached to a Product, published in the Developer Portal.

Developer Portal

A self-service portal where API consumers discover APIs and manage credentials.

Connectivity Link concepts (Kuadrant)

Concept Definition

Gateway

A Kubernetes Gateway API resource (gateway.networking.k8s.io/v1). Defines the ingress point backed by Istio.

HTTPRoute

Routes HTTP traffic to backend Services based on path, header, or host matching.

AuthPolicy

A Kuadrant CRD that attaches authentication rules to a Gateway or HTTPRoute. Supports API Key, JWT/OIDC, mTLS.

OIDCPolicy

A higher-level Kuadrant CRD that provides full OIDC flow (redirect, callback, token validation) on an HTTPRoute.

RateLimitPolicy

Enforces rate limits on a Gateway or HTTPRoute. Counters can be global or per-identity.

PlanPolicy

Defines tiered usage plans (free/basic/pro) with different rate limits via CEL predicates (expression language used in Kuadrant policies).

APIProduct

Publishes an API to the Kuadrant developer portal (Backstage plugin).

Authorino

The policy engine that evaluates AuthPolicy rules (JWT, API Key, OPA, pattern matching). Docs: Authorino getting started.

Limitador

The rate-limiting engine that enforces RateLimitPolicy counters via Envoy integration. Docs: Kuadrant architecture · Limitador metrics.

Feature comparison

Two smaller tables keep the map readable. Skim the So what bullets if you only need the takeaway.

Gateway, routing, and auth

Feature Red Hat 3scale Red Hat Connectivity Link

API Gateway

APIcast (NGINX-based, proprietary config)

Istio Gateway (Envoy-based, Gateway API standard)

Routing

MappingRules (method + pattern → metric)

HTTPRoute (Gateway API standard)

OIDC Auth

Product → OIDC issuer config

OIDCPolicy or AuthPolicy with JWT issuer

API Key Auth

Product → user_key / app_id+app_key

AuthPolicy with apiKey selector on labeled Secrets

Rate Limiting

Application Plans (per metric per plan)

RateLimitPolicy (per route, per identity, per window)

Usage Tiers

Application Plans (free/basic/pro)

PlanPolicy (CEL predicates on identity metadata)

Portal, GitOps, and observability

Feature Red Hat 3scale Red Hat Connectivity Link

Dev Portal

3scale Developer Portal (CMS-based)

Kuadrant APIProduct + Backstage plugin

API Docs

ActiveDoc (OpenAPI in 3scale portal)

APIProduct with OpenAPI URL + Backstage TechDocs

Configuration

3scale Admin UI / API / CRDs

Kubernetes CRDs + GitOps (ArgoCD)

GitOps

Partial (3scale Operator CRDs)

Native — all config is YAML in Git

Observability

3scale Analytics dashboard

Prometheus/Grafana + OpenTelemetry + Kiali

TLS Management

3scale admin config

TLSPolicy (automatic ACME/Let’s Encrypt)

DNS Management

External

DNSPolicy (Route 53, Cloud DNS)

So what? (if you skip the tables)

  • Gateway moves to standards: APIcast config → Gateway API + Istio/Envoy you already run on OpenShift.

  • Policy becomes GitOps YAML: auth and rate limits are CRDs next to the app, not a second admin plane.

  • Portal becomes platform DX: Developer Hub + APIProduct (and Kuadrant Console) replace the 3scale CMS for discovery and keys.

Why migrate?

  1. Standards-based: Gateway API is a Kubernetes standard supported by the CNCF. HTTPRoute, Gateway, and related resources are portable across implementations.

  2. GitOps-native: Every policy and route is a YAML CRD in Git. ArgoCD syncs the desired state to the cluster — no separate admin UI required.

  3. Granular policies: Attach auth and rate limiting at the Gateway or individual HTTPRoute level, rather than configuring a centralized gateway.

  4. Integrated developer experience: Kuadrant’s Backstage plugin surfaces APIProducts, plans, and key management directly inside Developer Hub.

  5. Cloud-native observability: Envoy/Istio metrics feed Prometheus and Grafana natively; OpenTelemetry and Kiali provide end-to-end tracing.

What this workshop does not cover

Connectivity Link is not a drop-in replacement for every 3scale feature. This lab focuses on routing, authentication, rate limiting / plans, GitOps, and day-2 UIs. It does not provide a 1:1 path for:

  • Billing / monetization and commercial Application Plan pricing workflows

  • The full 3scale Developer Portal CMS (themes, CMS pages, liquid templates) — CL uses APIProduct + Developer Hub / Backstage instead

  • Every APIcast custom policy (complex Lua / custom NGINX) — some patterns need EnvoyFilter / WASM or redesign

Treat those as separate migration workstreams outside this workshop.

Next

Continue with Architecture Overview.