Layer7 API Management

Expand all | Collapse all

Behavior of Export Variables from Fragment Assertion

  • 1.  Behavior of Export Variables from Fragment Assertion

    Posted Feb 15, 2019 11:30 AM

    Hi all,

    we put some of our functions into fragments to use them easier in different policies and to be more flexible in case of updates are required (then only the fragment needs to be updated and it will inherit into all involved policies). But some of these fragments are using variables, which will be used later in the policy (outside of this fragment) or maybe in another fragment, which will be executed at a later stage. As of now we are NOT using the "Export Variables from Fragment"-Assertion and everything is working fine.

    But how does this maybe affect overall performance? In that regards, what's the technical difference between using this assertion or not? CA documentation does not really say much about it. It mentions the words "For maximum performance", but doesn't explain what happend when not using it.

    And what about the other way round, means we define variables in the policy itself, which will then later be used within an included fragment. I assume this direction is not critical, isn't it?

    Who can provide some more technical details about this behavior and how this maybe Impacts overall Gateway performance.

    Thank you!

     

    Ciao Stefan



  • 2.  Re: Behavior of Export Variables from Fragment Assertion

    Broadcom Employee
    Posted Feb 19, 2019 02:03 PM

    Stefan,

     

    Good afternoon. One recommendation that I would make right away is that you look to create Encapsulated Assertions over Policy Fragments. This will control the input and output variables within the Encapsulated Assertion setup. The primary reason I recommend this approach is when updates are needed in live environments. The policy fragment will need to be updated in each and every policy that has the fragment where as the encapsulated assertion will load once and only the pointer in the service policy is updated once the next iteration of the policy is run.

     

    Sincerely,

     

    Stephen Hughes

    Broadcom Support



  • 3.  Re: Behavior of Export Variables from Fragment Assertion

    Posted Feb 21, 2019 06:05 AM

    Hi Stephen,

    I think this very interesting and important point should be documented officially here:

    https://docops.ca.com/ca-api-gateway/9-4/en/policy-assertions/encapsulated-assertions#EncapsulatedAssertions-EncapsulatedAssertionsComparedtoPolicyFragments

    Thank you!

     

    Ciao Stefan



  • 4.  Re: Behavior of Export Variables from Fragment Assertion

    Posted Feb 20, 2019 11:55 AM

    Hi Stephen,

    can you please explain in more Detail, what do you mean with "fragment will need to be updated in each and every policy that has the Fragment"?

    I can't believe that and also tested it right now. In the fragment I defined a multivalued variable with "allowed" values and in the real policy I'm checking if a value from a HTTP-header is included in that list. At the beginning the value was not included and I got the corresponding error. Then I just updated the fragment with a new value without touching the real policy again and it works. And I also can't remember any issues in our live environment with such a behavior.

    Also I'm preferring fragments as they are better during troubleshooting, especially within the debugger. It's not that "black box" feeling and you can also set breakpoints within the fragment. Or are there any other differences especially in regards to Performance between normal fragments and encapsulated assertions?

    And back to my initial question, what's the behavior of the Export Variables assertion? I mean using it vs. not using it.

    Thank you!

     

    Ciao Stefan  



  • 5.  Re: Behavior of Export Variables from Fragment Assertion
    Best Answer

    Broadcom Employee
    Posted Feb 20, 2019 12:14 PM

    Stefan,

     

    Excuse my wording on my last post as the update would not have to be done manually but by the gateway itself. Once you change a policy fragment, each and every service where that fragment exist will have the policy reloaded dynamically by the gateway. This can cause delay if the fragment is used in a large number of locations and if it is embedded within other policy fragments. 

     

    As for the usage of the Export Variables, this will help with establishing the variables that are going to be used in the policy which will provide a performance improvement over having to establish them as the policy is stepped through during execution. It does not stop the variables from being available if you don't include this assertion. 

     

    Export Variables from Fragment Assertion - CA API Gateway - 9.3 - CA Technologies Documentation 

     

    Why do the context variables need to be "made available"? For maximum performance, the CA API Gateway creates custom context variables only when it detects that the variables will be used by another assertion. In a policy fragment, it is not possible to determine ahead of time whether the variables within the fragment will be used in a policy that includes the fragment, so they are not created. The Export Variables from Fragment assertion allows you to flag specific variables as being "in use".

     

    Sincerely,

     

    Stephen Hughes

    Broadcom Support



  • 6.  Re: Behavior of Export Variables from Fragment Assertion

    Posted Mar 13, 2019 12:18 PM

    Hi Stephen,

    one final question in this regards. When creating an encapsulated Assertion from a Policy Fragment and defining my Input and Output variables accordingly, do I still need the "Export Variables from Fragment"-Assertion?

    The reason why I'm asking, if I have that Export-Assertion active in my Fragment and starting the "Create Encapsulated Assertion"-wizzard and select Autopopulate "Yes", the Output-sections stays empty. Whereas without the Export-Assertion, the Output-variables will be filled correctly. So are the Output-variables behaving the same as the Export-Assertion? Does it matter, when I have the Export-Assertion still defined anyway?

    Thank you!

     

    Ciao Stefan



  • 7.  Re: Behavior of Export Variables from Fragment Assertion

    Broadcom Employee
    Posted Mar 13, 2019 01:43 PM

    Stefan,

     

    I would recommend that you don't use the Export Variable assertion if you are using the policy for Encapsulated assertion. The output variables does mirror the behavior of the Export Variable assertion as identifying what is being set ahead of time. The additional piece is that the output variables will show when you work with the assertion in the service policy.

     

    Sincerely,

     

    Stephen Hughes

    Broadcom Support



  • 8.  Re: Behavior of Export Variables from Fragment Assertion

    Posted Mar 14, 2019 02:27 AM

    Thanks Stephen for confirmation.

    That's exactly what I wanted to hear

     

    Ciao Stefan



  • 9.  Re: Behavior of Export Variables from Fragment Assertion

    Posted Mar 18, 2019 07:17 AM

    Hi Stephen,

    you never should say "last" question, because I still found another one

    Is there any difference, especially in regards to performance, according to the following two methods?

    1. Using an encapsulated Assertion with just a single variable and include this Assertion in all policies, where this variable is required.

    2. Using a CWP for that single variable and reference it via "gateway.<name-of-the-CWP>" context variable in all policies, where this variable is required.

     

    What happens, when I change the content of this variable? Is one of both methods better or doesn't matter?

    Thank you!

     

    Ciao Stefan



  • 10.  Re: Behavior of Export Variables from Fragment Assertion

    Broadcom Employee
    Posted Mar 18, 2019 12:28 PM

    Stefan,

     

    I'm not sure of the performance difference but I would think that it is would be nominal. From a management perceptive, the CWP makes more sense to use for migration and policy development.

     

    Sincerely,

     

    Stephen Hughes

    Broadcom Support



  • 11.  Re: Behavior of Export Variables from Fragment Assertion

    Posted Mar 18, 2019 12:41 PM

    Hi Stephen,

    yes the management perspective is also your idea behind this. But due to the findings and "bad" experiences from the previous discussion, I would be on the safe side.

    Thank you!

     

    Ciao Stefan