Review the CRCPLAN parent feature for additional context, including the feature overview, goals, user stories and use cases, acceptance criteria, designs, dependencies, risks, assumptions, pending questions and documentation callouts.

Summary and goal

The HCC UI, RHSM, OCM and other Management Fabric adopters who are not deployed in the same cluster as the core Management Fabric services (primarily Kessel Inventory) will need to access Kessel through console.redhat.com vs internally via cluster services directly as other HCC and Insights services do. Work is needed across multiple services in order to enable and secure this functionality.

Acceptance Criteria 

These conditions must be met for the epic to be considered complete. This provides a detailed definition of scope and the expected outcomes, written from a user's point of view.

1. As a service, my workloads which are deployed on a separate cluster from HCC and Kessel services should be able to authenticate and have access requests fulfilled by Kessel services using REST/HTTP against console.redhat.com, using a user JWT or service account from RHSSO.
2. As a service, my workloads which are deployed on a separate cluster from HCC and Kessel services should be able to authenticate and have access requests fulfilled by Kessel services using gRPC against console.redhat.com, using a user JWT or service account from RHSSO.
3. As an external service, I should be able to consume messages from Kessel-driven Kafka messages.
4. As an external service, I should have a strategy for testing against Kessel services, assuming my service is not a clowdapp.

Checklist

Open Questions

Do any of these external services require bootstrapping without first visiting console?

• e.g. is subs inventory still available outside console?